click.arcflag.fr Open in urlscan Pro
193.107.76.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345
Submission Tags: falconsandbox
Submission: On July 05 via api (July 5th 2021, 12:48:08 pm UTC) from US

Summary HTTP 6 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 6 HTTP transactions. The main IP is 193.107.76.2, located in Germany and belongs to AUDIENCESERV, DE. The main domain is click.arcflag.fr.
TLS certificate: Issued by R3 on July 3rd 2021. Valid for: 3 months.

This is the only time click.arcflag.fr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	193.107.76.2 193.107.76.2		212886 (AUDIENCESERV) (AUDIENCESERV)
1	2a00:1450:400... 2a00:1450:4001:82f::200a		15169 (GOOGLE) (GOOGLE)
2	52.219.72.171 52.219.72.171		16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:803::2003		15169 (GOOGLE) (GOOGLE)
6	4

1 193.107.76.2 (Germany)

ASN212886 (AUDIENCESERV, DE)
PTR: smtp1-1.initialnews.de

click.arcflag.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.219.72.171 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: s3.eu-central-1.amazonaws.com

s3.eu-central-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com fonts.gstatic.com	29 KB
2	amazonaws.com s3.eu-central-1.amazonaws.com	198 KB
1	googleapis.com fonts.googleapis.com	739 B
1	arcflag.fr click.arcflag.fr	8 KB
6	4

	Domain	Requested by
2	fonts.gstatic.com	fonts.googleapis.com
2	s3.eu-central-1.amazonaws.com	click.arcflag.fr
1	fonts.googleapis.com	click.arcflag.fr
1	click.arcflag.fr
6	4

This site contains links to these domains. Also see Links.

Domain
destinationpush.com

Subject Issuer	Validity	Valid
click.arcflag.fr R3	`2021-07-03` - `2021-10-01`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.s3.eu-central-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2020-08-27` - `2021-09-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345
Frame ID: 1B59200F821CCBAE4FF409582CE0D47F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

235 kB
Transfer

238 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://destinationpush.com/click/click-tracking?gid=5d49e2634101850b759f426a&sid=NnK6bu2Cc&flux_fts=azlpizollloplczaloetqqtlcpatcqxcpttqzz5eae7&puid=2595145adab286a54aea6154e1b18466

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 4-223931367-204-97008-97106-186199-41fae7e345 Show response
click.arcflag.fr/ga/webviews/ 7 KB
8 KB 232ms
153ms Document
text/html 193.107.76.2
AUDIENCESERV

General

Check archive.org

Show headers Download Go to

Full URL: https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 193.107.76.2 , Germany, ASN212886 (AUDIENCESERV, DE),
Reverse DNS: smtp1-1.initialnews.de
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1 PHP/7.3.27 / Phusion Passenger 6.0.7
Resource Hash: 7713a64d2fc7bef41de2f3e2538782bcd2786fc4ae1f46644070321f7c92495d

Request headers

Host: click.arcflag.fr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 12:47:50 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1 PHP/7.3.27
Status: 200 OK
X-Rack-Cache: miss
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-Request-Id: 559b6a7885bf10acb021a6608b7ae77b
X-UA-Compatible: IE=Edge,chrome=1
X-Runtime: 0.128394
Expires: Mon, 01 Jan 1990 00:00:00 GMT
X-Powered-By: Phusion Passenger 6.0.7
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
739 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap

Requested by

Host: click.arcflag.fr
URL: https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6aa6360b39fe982bd5f7cdf9bd09d2ea596614697679c98ad347111aab2b38dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://click.arcflag.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 11:24:14 GMT
server: ESF
date: Mon, 05 Jul 2021 12:47:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 12:47:50 GMT

GET
H/1.1 200
OK 09_cropped-datinglogo1.png
s3.eu-central-1.amazonaws.com/media.wilzefr.com/2021-06-18/VKbybcptM/ 8 KB
8 KB 109ms
35ms Image
image/png 52.219.72.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.eu-central-1.amazonaws.com/media.wilzefr.com/2021-06-18/VKbybcptM/09_cropped-datinglogo1.png
Requested by: Host: click.arcflag.fr
URL: https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.72.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: s3.eu-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0a39188212ccba63c5e69116b58764daba05eb62690514051be488f59531ddd0

Request headers

Referer: https://click.arcflag.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 12:47:51 GMT
Last-Modified: Fri, 18 Jun 2021 08:30:02 GMT
Server: AmazonS3
x-amz-request-id: BQ0BBZ3Z90VVWD7W
ETag: "d444761823ead7616502017c62ba5180"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 8153
x-amz-id-2: TNHLjUvKzxs2K9zDie2futodJEZEKKz1+lwcMQpEIpda5aqqhq7MVA2WHfSVZL4PAOK+nVTEidA=

GET
H/1.1 200
OK dating1.jpg
s3.eu-central-1.amazonaws.com/media.wilzefr.com/2021-06-18/cCMwbLLbo/ 189 KB
190 KB 107ms
34ms Image
image/jpeg 52.219.72.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.eu-central-1.amazonaws.com/media.wilzefr.com/2021-06-18/cCMwbLLbo/dating1.jpg
Requested by: Host: click.arcflag.fr
URL: https://click.arcflag.fr/ga/webviews/4-223931367-204-97008-97106-186199-41fae7e345
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.72.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: s3.eu-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: f8597f0de6c65b046bfb23b9d2f7600675ba1d456655981a97094ffddef325a4

Request headers

Referer: https://click.arcflag.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 12:47:51 GMT
Last-Modified: Fri, 18 Jun 2021 08:08:20 GMT
Server: AmazonS3
x-amz-request-id: BQ02QDNN98XM2W6E
ETag: "687c275b6e5b23dce65b6f919fc6ecd2"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 193772
x-amz-id-2: UeTmOt9EY7NbrKVUI2B9AT200l9d5kvaCQSuVTwjFj3slsI9s9eurFAygX8V8MRrMFxCrJ8EcLU=

GET
H3-29 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://click.arcflag.fr
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 13:09:35 GMT
x-content-type-options: nosniff
age: 430695
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 13:09:35 GMT

GET
H3-29 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://click.arcflag.fr
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 16:31:16 GMT
x-content-type-options: nosniff
age: 504994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 16:31:16 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

click.arcflag.fr
fonts.googleapis.com
fonts.gstatic.com
s3.eu-central-1.amazonaws.com
193.107.76.2
2a00:1450:4001:803::2003
2a00:1450:4001:82f::200a
52.219.72.171
0a39188212ccba63c5e69116b58764daba05eb62690514051be488f59531ddd0
6aa6360b39fe982bd5f7cdf9bd09d2ea596614697679c98ad347111aab2b38dc
7713a64d2fc7bef41de2f3e2538782bcd2786fc4ae1f46644070321f7c92495d
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
f8597f0de6c65b046bfb23b9d2f7600675ba1d456655981a97094ffddef325a4