urlscan.io logo urlscan.io
SecurityTrails logo

messagent.roulartamail.be Open in urlscan Pro
91.212.185.86  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.kw.be/meerdanjeverwacht
Effective URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5...
Submission: On January 19 via api from BE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 5 countries across 11 domains to perform 13 HTTP transactions. The main IP is 91.212.185.86, located in Mechelen, Belgium and belongs to ROULARTA-MEDIA-GROUP-AS, BE. The main domain is messagent.roulartamail.be.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on October 5th 2018. Valid for: 2 years.
This is the only time messagent.roulartamail.be was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    217.19.237.54 (Brussels, Belgium)

ASN34762 (COMBELL-AS, BE)
PTR: 217.19.237.54.static.hosted.by.combell.com
www.kw.be
2    95.131.143.129 (France)

ASN47841 (OXALIDE, FR)
kw.be
3    91.212.185.86 (Mechelen, Belgium)

ASN49333 (ROULARTA-MEDIA-GROUP-AS, BE)
PTR: 86-185-212-91.rmg.be
messagent.roulartamail.be
1    2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    178.32.205.233 (Poland)

ASN16276 (OVH, FR)
gabe.hit.gemius.pl
1    2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
Domain Requested by
4 gabe.hit.gemius.pl 1 redirects messagent.roulartamail.be
gabe.hit.gemius.pl
3 messagent.roulartamail.be messagent.roulartamail.be
2 www.google-analytics.com 1 redirects www.googletagmanager.com
2 fonts.gstatic.com messagent.roulartamail.be
2 kw.be 2 redirects
1 www.google.de messagent.roulartamail.be
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 www.googletagmanager.com messagent.roulartamail.be
1 fonts.googleapis.com messagent.roulartamail.be
1 maxcdn.bootstrapcdn.com messagent.roulartamail.be
1 www.kw.be 1 redirects
13 12

This site contains no links.

Subject Issuer Validity Valid
messagent.roulartamail.be
COMODO RSA Domain Validation Secure Server CA		 2018-10-05 -
2020-10-04		 2 years crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2019-12-20 -
2020-03-13		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-12-20 -
2020-03-13		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-12-20 -
2020-03-13		 3 months crt.sh
*.hit.gemius.pl
Sectigo ECC Domain Validation Secure Server CA		 2019-09-11 -
2021-09-24		 2 years crt.sh
www.google.de
GTS CA 1O1		 2019-12-20 -
2020-03-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Frame ID: 25C2F69AFA6F1A408D5FC6C77BBC5709
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.kw.be/meerdanjeverwacht HTTP 301
    http://kw.be/meerdanjeverwacht HTTP 301
    https://kw.be/meerdanjeverwacht HTTP 302
    https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: %
Detected patterns
  • script /hit\.gemius\.pl\/xgemius\.js/i
  • script /hit\.gemius\.pl/i
  • script /xgemius\.js/i

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

11
Domains

12
Subdomains

8
IPs

5
Countries

863 kB
Transfer

1119 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.kw.be/meerdanjeverwacht HTTP 301
    http://kw.be/meerdanjeverwacht HTTP 301
    https://kw.be/meerdanjeverwacht HTTP 302
    https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=738186018&t=pageview&_s=1&dl=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0pLwPBqcCEmPEhp3%252BwNzjxvqeaGpoIXGS5ukSR%252BXXyrWRxUKR&dp=virtual%2Fprod%2Fkw%2Fkw2020%2F202001%2Fnl%2Fhome&ul=en-us&de=UTF-8&dt=kw2020%20-%20home&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=1471449009&gjid=302976732&cid=308343207.1579461269&tid=UA-8272409-18&_gid=684300259.1579461269&_r=1&gtm=2wg181MHVRMGQ&cd10=kw&cd11=kw2020&cd12=202001&cd13=nl&cd14=home&cd17=RMG&cd18=site-messagent-nl&z=2083819337 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_gid=684300259.1579461269&gjid=302976732&_v=j79&z=2083819337 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337&slf_rd=1&random=1220428027
Request Chain 11
  • https://gabe.hit.gemius.pl/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0pLwPBqcCEmPEhp3%252BwNzjxvqeaGpoIXGS5ukSR%252BXXyrWRxUKR&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=1Cvbq3SYOLXWqbTqPFgEwxYg5MPb5OBSila8qGK.FF3.t7&vis=1 HTTP 301
  • https://gabe.hit.gemius.pl/__/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0pLwPBqcCEmPEhp3%252BwNzjxvqeaGpoIXGS5ukSR%252BXXyrWRxUKR&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=1Cvbq3SYOLXWqbTqPFgEwxYg5MPb5OBSila8qGK.FF3.t7&vis=1

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request optiextension.dll
messagent.roulartamail.be/optiext/
Redirect Chain
  • http://www.kw.be/meerdanjeverwacht
  • http://kw.be/meerdanjeverwacht
  • https://kw.be/meerdanjeverwacht
  • https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.212.185.86 Mechelen, Belgium, ASN49333 (ROULARTA-MEDIA-GROUP-AS, BE),
Reverse DNS
86-185-212-91.rmg.be
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
0cf08b3d62e7729332e974a2dd98e7fbce41eb392a17e4e40edaf0b6663b4b5e

Request headers

Host
messagent.roulartamail.be
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
text/html
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Access-Control-Allow-Origin
*
Date
Sun, 19 Jan 2020 19:14:25 GMT
X-Varnish-PTTL
0.000
X-Varnish-C
N
Content-Encoding
gzip
X-Varnish
116535141
Age
0
Via
1.1 varnish-v4
X-Varnish-H
M
X-Varnish-B
messagt
Content-Length
2033
Accept-Ranges
bytes

Redirect headers

Server
nginx
Date
Sun, 19 Jan 2020 19:14:28 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
312
Connection
keep-alive
Cache-Control
no-cache
Location
//messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Content-Encoding
gzip
Accept-Ranges
bytes
Age
0
X-Backend
dir_www_01
X-Cache
MISS :(
X-Powered-By
Oxalide [01]
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ 		141 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Origin
https://messagent.roulartamail.be

Response headers

date
Sun, 19 Jan 2020 19:14:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:10 GMT
access-control-allow-origin
*
etag
"1544639650"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
20563
css
fonts.googleapis.com/ 		7 KB
739 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,600,700,900&display=swap
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c03ce74661e68bfeeebe02b5c8e867b5d0018c060af3881fff5b53e74f77133
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 19 Jan 2020 19:14:28 GMT
server
ESF
access-control-allow-origin
*
date
Sun, 19 Jan 2020 19:14:28 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Sun, 19 Jan 2020 19:14:28 GMT
logo-kw.png
messagent.roulartamail.be/images/preweb2/journey/kw/2020/kw2020/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://messagent.roulartamail.be/images/preweb2/journey/kw/2020/kw2020/logo-kw.png
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.212.185.86 Mechelen, Belgium, ASN49333 (ROULARTA-MEDIA-GROUP-AS, BE),
Reverse DNS
86-185-212-91.rmg.be
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
a31b6cbcdac76f8de942ef17d40f9d6145b55708de527585707ccd64fabd5fc1

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sun, 19 Jan 2020 19:01:33 GMT
Via
1.1 varnish-v4
Age
773
X-Powered-By
ASP.NET
X-Varnish-B
messagt
X-Varnish-C
Y
Content-Length
4485
Last-Modified
Fri, 03 Jan 2020 09:14:55 GMT
Server
Microsoft-IIS/10.0
X-Varnish-H
H#1/2827.339
ETag
"d09a474316c2d51:0"
X-Varnish-PTTL
3600.000
X-Varnish
115569224 116072028
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Content-Type
image/png
gtm.js
www.googletagmanager.com/ 		113 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MHVRMGQ
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
04cfd7bbc1cb58de9bf5e7016aa9d6aaf2a4c8a541d94f32cde6f30320a1d344
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sun, 19 Jan 2020 19:14:28 GMT
content-encoding
br
last-modified
Sun, 19 Jan 2020 18:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
35827
x-xss-protection
0
expires
Sun, 19 Jan 2020 19:14:28 GMT
bg-landingspagina.jpg
messagent.roulartamail.be/images/preweb2/journey/kw/2020/kw2020/ 		750 KB
750 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://messagent.roulartamail.be/images/preweb2/journey/kw/2020/kw2020/bg-landingspagina.jpg
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.212.185.86 Mechelen, Belgium, ASN49333 (ROULARTA-MEDIA-GROUP-AS, BE),
Reverse DNS
86-185-212-91.rmg.be
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
31faebe3cc086c8a6ab1fee17d33781db8b632c05f56bae5865d34c9c3383b39

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Sun, 19 Jan 2020 19:01:33 GMT
Via
1.1 varnish-v4
Age
772
X-Powered-By
ASP.NET
X-Varnish-B
messagt
X-Varnish-C
Y
Content-Length
767943
Last-Modified
Fri, 03 Jan 2020 09:14:56 GMT
Server
Microsoft-IIS/10.0
X-Varnish-H
H#1/2827.583
ETag
"2a4ad44316c2d51:0"
X-Varnish-PTTL
3600.000
X-Varnish
115569229 115579863
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Content-Type
image/jpeg
KFOlCnqEu92Fr1MmYUtfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmYUtfBBc4AMP6lQ.woff2
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b6863771c330f7b6a857dbfee3959d8e8c61c0e34f1e9ba5f6f38268d05573d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,600,700,900&display=swap
Origin
https://messagent.roulartamail.be

Response headers

date
Thu, 16 Jan 2020 19:50:51 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:19:08 GMT
server
sffe
age
257017
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11012
x-xss-protection
0
expires
Fri, 15 Jan 2021 19:50:51 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,600,700,900&display=swap
Origin
https://messagent.roulartamail.be

Response headers

date
Thu, 09 Jan 2020 00:21:24 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
931984
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Fri, 08 Jan 2021 00:21:24 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MHVRMGQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
2455
date
Sun, 19 Jan 2020 18:33:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Sun, 19 Jan 2020 20:33:33 GMT
xgemius.js
gabe.hit.gemius.pl/ 		33 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gabe.hit.gemius.pl/xgemius.js
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
178.32.205.233 , Poland, ASN16276 (OVH, FR),
Reverse DNS
Software
GHC /
Resource Hash
53d2b310b78267a9c18bc1bbc3885d58d12d8fe5b286d8c9aa482331757b9812

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sun, 19 Jan 2020 19:14:28 GMT
content-encoding
gzip
last-modified
Fri, 27 Dec 2019 13:18:54 GMT
server
GHC
vary
Accept-Encoding,Origin
p3p
CP="NOI DSP COR NID PSAo OUR IND"
status
200
cache-control
max-age=43200
accept-ranges
none
content-type
application/x-javascript
content-length
9255
expires
Mon, 20 Jan 2020 07:14:28 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=738186018&t=pageview&_s=1&dl=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0p...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_gid=684300259.1579461269&gjid=302976732&_v=j79&z=2083819337
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337&slf_rd=1&random=1220428027
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337&slf_rd=1&random=1220428027
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 19 Jan 2020 19:14:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 19 Jan 2020 19:14:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-8272409-18&cid=308343207.1579461269&jid=1471449009&_v=j79&z=2083819337&slf_rd=1&random=1220428027
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
fpdata.js
gabe.hit.gemius.pl/ 		273 B
386 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gabe.hit.gemius.pl/fpdata.js?href=messagent.roulartamail.be
Requested by
Host: gabe.hit.gemius.pl
URL: https://gabe.hit.gemius.pl/xgemius.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
178.32.205.233 , Poland, ASN16276 (OVH, FR),
Reverse DNS
Software
GHC /
Resource Hash
1b3ac2b04ddb3dfd23ec5903c9075f4157c22335fcdfb57471c8633842918f6c

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sun, 19 Jan 2020 19:14:28 GMT
last-modified
Mon, 16 Jul 2012 10:03:40 GMT
server
GHC
etag
PRIVATE7520710249
p3p
CP="NOI DSP COR NID PSAo OUR IND"
status
200
cache-control
private, max-age=2592000
accept-ranges
none
content-type
application/x-javascript
content-length
273
expires
Tue, 18 Feb 2020 19:14:28 GMT
rexdot.js
gabe.hit.gemius.pl/__/_1579461268873/
Redirect Chain
  • https://gabe.hit.gemius.pl/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=http...
  • https://gabe.hit.gemius.pl/__/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=h...
180 B
440 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gabe.hit.gemius.pl/__/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0pLwPBqcCEmPEhp3%252BwNzjxvqeaGpoIXGS5ukSR%252BXXyrWRxUKR&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=1Cvbq3SYOLXWqbTqPFgEwxYg5MPb5OBSila8qGK.FF3.t7&vis=1
Requested by
Host: messagent.roulartamail.be
URL: https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
178.32.205.233 , Poland, ASN16276 (OVH, FR),
Reverse DNS
Software
GHC /
Resource Hash
e0b905f52ba1fb24ad49b7d86a3edb3389f4451c470bfe7945225f2948295c2a

Request headers

Referer
https://messagent.roulartamail.be/optiext/optiextension.dll?ID=6BJGIK0inDuQPt1ME76Lz8oDyN%2BvW0pLwPBqcCEmPEhp3%2BwNzjxvqeaGpoIXGS5ukSR%2BXXyrWRxUKR
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 19 Jan 2020 19:14:28 GMT
server
GHC
p3p
CP="NOI DSP COR NID PSAo OUR IND"
status
200
cache-control
no-store, no-cache, must-revalidate, max-age=0
accept-ranges
none
content-type
application/x-javascript
content-length
180
expires
Sat, 18 Jan 2020 19:14:28 GMT

Redirect headers

pragma
no-cache
date
Sun, 19 Jan 2020 19:14:28 GMT
server
GHC
location
/__/_1579461268873/rexdot.js?l=100&id=ndo70jLvcOkCg9tcys2RFaRu.l0uwIcmnz5DMEj9D6P.r7&et=view&hsrc=1&initsonar=1&extra=lan%3DNL%7Ckey%3Dkw&eventid=0&fr=1&tz=-60&fv=-&href=https%3A%2F%2Fmessagent.roulartamail.be%2Foptiext%2Foptiextension.dll%3FID%3D6BJGIK0inDuQPt1ME76Lz8oDyN%252BvW0pLwPBqcCEmPEhp3%252BwNzjxvqeaGpoIXGS5ukSR%252BXXyrWRxUKR&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=1Cvbq3SYOLXWqbTqPFgEwxYg5MPb5OBSila8qGK.FF3.t7&vis=1
p3p
CP="NOI DSP COR NID PSAo OUR IND"
status
301
cache-control
no-store, no-cache, must-revalidate, max-age=0
accept-ranges
none
content-length
0
expires
Sat, 18 Jan 2020 19:14:28 GMT

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga string| pp_gemius_identifier object| pp_gemius_extraparameters object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| gemius_cmpclient object| gemius_hcconn function| gemius_hit function| gemius_event function| pp_gemius_hit function| pp_gemius_event number| pp_gemius_cnt boolean| gemius_hcref

4 Cookies

Domain/Path Name / Value
.roulartamail.be/ Name: _gat_UA-8272409-18
Value: 1
.roulartamail.be/ Name: _gid
Value: GA1.2.684300259.1579461269
.roulartamail.be/ Name: __gfp_64b
Value: 1Cvbq3SYOLXWqbTqPFgEwxYg5MPb5OBSila8qGK.FF3.t7
.roulartamail.be/ Name: _ga
Value: GA1.2.308343207.1579461269

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
gabe.hit.gemius.pl
kw.be
maxcdn.bootstrapcdn.com
messagent.roulartamail.be
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.kw.be
178.32.205.233
2001:4de0:ac19::1:b:2b
217.19.237.54
2a00:1450:4001:806::200a
2a00:1450:4001:814::2003
2a00:1450:4001:814::200e
2a00:1450:4001:81a::2008
2a00:1450:4001:81b::2004
2a00:1450:4001:824::2003
2a00:1450:400c:c0c::9a
91.212.185.86
95.131.143.129
04cfd7bbc1cb58de9bf5e7016aa9d6aaf2a4c8a541d94f32cde6f30320a1d344
0cf08b3d62e7729332e974a2dd98e7fbce41eb392a17e4e40edaf0b6663b4b5e
1b3ac2b04ddb3dfd23ec5903c9075f4157c22335fcdfb57471c8633842918f6c
1b6863771c330f7b6a857dbfee3959d8e8c61c0e34f1e9ba5f6f38268d05573d
1c03ce74661e68bfeeebe02b5c8e867b5d0018c060af3881fff5b53e74f77133
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
31faebe3cc086c8a6ab1fee17d33781db8b632c05f56bae5865d34c9c3383b39
53d2b310b78267a9c18bc1bbc3885d58d12d8fe5b286d8c9aa482331757b9812
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
a31b6cbcdac76f8de942ef17d40f9d6145b55708de527585707ccd64fabd5fc1
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e0b905f52ba1fb24ad49b7d86a3edb3389f4451c470bfe7945225f2948295c2a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629