rickrolled.fr - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 5.39.69.69, located in France and belongs to OVH, FR. The main domain is rickrolled.fr.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 10th 2018. Valid for: 3 months.

This is the only time rickrolled.fr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	5.39.69.69 5.39.69.69	16276 (OVH) (OVH)
2	216.58.207.72 216.58.207.72	15169 (GOOGLE) (GOOGLE - Google LLC)
4	3

3 5.39.69.69 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: wiki.koreus.com

rickrolled.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.207.72 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f8.1e100.net

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	rickrolled.fr 1 redirects rickrolled.fr	1 KB
2	google-analytics.com ssl.google-analytics.com	17 KB
4	2

	Domain	Requested by
3	rickrolled.fr	1 redirects rickrolled.fr
2	ssl.google-analytics.com	rickrolled.fr
4	2

This site contains links to these domains. Also see Links.

Domain
koreus.net

Subject Issuer	Validity	Valid
rickrolled.fr Let's Encrypt Authority X3	`2018-04-10` - `2018-07-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rickrolled.fr/
Frame ID: E37340C8E057FF6FCC99ACEF36CB16F7
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://rickrolled.fr/ HTTP 301
https://rickrolled.fr/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

18 kB
Transfer

3440 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://koreus.net/
Title: Koreus Network

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rickrolled.fr/ HTTP 301
https://rickrolled.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
rickrolled.fr/
Redirect Chain

http://rickrolled.fr/
https://rickrolled.fr/

1 KB
1 KB

46ms
13ms

Document
text/html

5.39.69.69
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://rickrolled.fr/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 5.39.69.69 , France, ASN16276 (OVH, FR),
Reverse DNS: wiki.koreus.com
Software: nginx/1.10.3 /
Resource Hash: 7aec49357433ad9d209ac7dfd60501a3d07ec00d73a2e6b157bc9ff8de64c60c

Request headers

:path: /
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: rickrolled.fr
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Fri, 04 May 2018 03:59:57 GMT
last-modified: Wed, 01 Feb 2017 01:56:23 GMT
server: nginx/1.10.3
etag: "58914047-433"
content-type: text/html
status: 200
accept-ranges: bytes
content-length: 1075

Redirect headers

Location: https://rickrolled.fr/
Date: Fri, 04 May 2018 03:59:57 GMT
Server: nginx/1.10.3
Connection: keep-alive
Keep-Alive: timeout=20
Content-Length: 185
Content-Type: text/html

GET
S 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 27ms
5ms Script
text/javascript 216.58.207.72
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: rickrolled.fr
URL: https://rickrolled.fr/

Protocol

SPDY

Server

216.58.207.72 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://rickrolled.fr/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Apr 2018 18:13:11 GMT
server: Golfe2
age: 5193
date: Fri, 04 May 2018 02:33:24 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 17168
expires: Fri, 04 May 2018 04:33:24 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H2 206 rickroll.mp4
rickrolled.fr/ 3 MB
0 26ms
26ms Media
video/mp4 5.39.69.69
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://rickrolled.fr/rickroll.mp4
Requested by: Host: rickrolled.fr
URL: https://rickrolled.fr/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 5.39.69.69 , France, ASN16276 (OVH, FR),
Reverse DNS: wiki.koreus.com
Software: nginx/1.10.3 /
Resource Hash

Request headers

:path: /rickroll.mp4
pragma: no-cache
accept-encoding: identity;q=1, *;q=0
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
chrome-proxy: frfr
accept: */*
cache-control: no-cache
:authority: rickrolled.fr
referer: https://rickrolled.fr/
:scheme: https
range: bytes=0-
:method: GET
Referer: https://rickrolled.fr/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

date: Fri, 04 May 2018 03:59:57 GMT
last-modified: Wed, 01 Feb 2017 01:50:42 GMT
server: nginx/1.10.3
etag: "58913ef2-1005c78"
status: 206
content-type: video/mp4
Content-Range: bytes 0-16800887/16800888
Content-Length: 16800888

GET
S 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
200 B 13ms
13ms Image
image/gif 216.58.207.72
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=760951537&utmhn=rickrolled.fr&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=YOU%20GOT%20RICK%20ROLLED&utmhid=533501297&utmr=-&utmp=%2F&utmht=1525406397806&utmac=UA-366474-6&utmcc=__utma%3D207939473.98317106.1525406398.1525406398.1525406398.1%3B%2B__utmz%3D207939473.1525406398.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1458729594&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: rickrolled.fr
URL: https://rickrolled.fr/

Protocol

SPDY

Server

216.58.207.72 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://rickrolled.fr/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 May 2018 03:59:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rickrolled.fr/	1970-01-18 15:43:28	Name: __utmb Value: 207939473.1.10.1525406398
.rickrolled.fr/	1970-01-18 15:43:26	Name: __utmt Value: 1
.rickrolled.fr/	1970-01-18 20:06:14	Name: __utmz Value: 207939473.1525406398.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.rickrolled.fr/	1969-12-31 23:59:59	Name: __utmc Value: 207939473
.rickrolled.fr/	1970-01-19 09:14:38	Name: __utma Value: 207939473.98317106.1525406398.1525406398.1525406398.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rickrolled.fr
ssl.google-analytics.com
216.58.207.72
5.39.69.69
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
7aec49357433ad9d209ac7dfd60501a3d07ec00d73a2e6b157bc9ff8de64c60c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

rickrolled.fr Open in urlscan Pro 5.39.69.69 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

18 kBTransfer

3440 kBSize

5 Cookies

1 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

5 Cookies

Indicators

rickrolled.fr Open in urlscan Pro
5.39.69.69 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

18 kB
Transfer

3440 kB
Size

5
Cookies

4 HTTP transactions
1 data transactions