news.mailclick.me Open in urlscan Pro
34.125.138.136 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Effective URL:
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Submission: On July 20 via api (July 20th 2023, 9:44:05 pm UTC) from US — Scanned from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.125.138.136, located in Las Vegas, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is news.mailclick.me.
TLS certificate: Issued by R3 on July 17th 2023. Valid for: 3 months.

This is the only time news.mailclick.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	34.125.138.136 34.125.138.136	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	104.237.62.211 104.237.62.211	18450 (WEBNX) (WEBNX)
9	2

9 34.125.138.136 (Las Vegas, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 136.138.125.34.bc.googleusercontent.com

news.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
smith.armor.zone	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.237.62.211 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	armor.zone smith.armor.zone	122 KB
2	mailclick.me 1 redirects news.mailclick.me	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2618	206 B
9	3

	Domain	Requested by
7	smith.armor.zone	news.mailclick.me smith.armor.zone
2	news.mailclick.me	1 redirects
1	api.ipify.org	smith.armor.zone
9	3

This site contains no links.

Subject Issuer	Validity	Valid
news.mailclick.me R3	`2023-07-17` - `2023-10-15`	3 months	crt.sh
smith.armor.zone R3	`2023-07-18` - `2023-10-16`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Frame ID: AC4F176546C9D6E204AC2A6F46A84F44
Requests: 1 HTTP requests in this frame

Frame: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone
Frame ID: 6ECC522EF0A0CB536DE6DA62ED2269BB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	Primary Request tl.php Show response news.mailclick.me/ Redirect Chain http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/	647 B 556 B	1139ms 809ms	Document text/html	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `78e112f934ea9df2ef270d3da8140b1589cf0dd3baab0f414186f8766d26beee` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Thu, 20 Jul 2023 21:44:01 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security Redirect headers Connection keep-alive Content-Length 243 Content-Type text/html; charset=iso-8859-1 Date Thu, 20 Jul 2023 21:44:00 GMT Location https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Public-Key-Pins pin-sha256="qqmFDnGuWc+Y3Fiz0wVRpi8Gyst9PPl/bntrmJLWHEY="; pin-sha256="XTVE99mOJYqvWYVDTiW5/u/vVR2VqZHFjGy9/pMdMxs="; max-age=300 Secured By XLabs Security www.xlabs.com.br Server XLabs WAF v4.0 http://www.xlabs.com.br/waf Strict-Transport-Security max-age=63072000; preload x-cdn XLabs Security
GET H2	200	host_block Show response smith.armor.zone/ Frame 6ECC	3 KB 1 KB	933ms 174ms	Document text/html	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Requested by Host: news.mailclick.me URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `a847638b5a0eb232ff14ab8b11b3cbe91e2798003b6bc6006b88c89212edd797` Request headers Referer https://news.mailclick.me/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers content-encoding gzip content-type text/html;charset=UTF-8 date Thu, 20 Jul 2023 21:44:02 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security
GET H2	200	bootstrap-4.4.1.css smith.armor.zone/styles/ Frame 6ECC	193 KB 35 KB	174ms 173ms	Stylesheet text/css	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/styles/bootstrap-4.4.1.css Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"197413-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:44:03 GMT
GET H2	200	style_error.css smith.armor.zone/styles/ Frame 6ECC	7 KB 2 KB	338ms 337ms	Stylesheet text/css	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/styles/style_error.css Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"7118-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:44:03 GMT
GET H/1.1	200 OK	/ Show response api.ipify.org/ Frame 6ECC	32 B 206 B	526ms 174ms	Script application/javascript	104.237.62.211 WEBNX
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.237.62.211 El Segundo, United States, ASN18450 (WEBNX, US), Reverse DNS hosted-by.racknerd.com Software nginx/1.25.1 / Resource Hash `3c0495145f777e181ad57c4fd8dc74148e7269a0be702d067ba61cd15d20dbf5` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers Date Thu, 20 Jul 2023 21:44:03 GMT Server nginx/1.25.1 Connection keep-alive Content-Length 32 Vary Origin Content-Type application/javascript
GET H2	200	elements_error.svg smith.armor.zone/images/ Frame 6ECC	6 KB 7 KB	184ms 184ms	Image image/svg+xml	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://smith.armor.zone/images/elements_error.svg Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT last-modified Wed, 31 May 2023 02:25:20 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"6640-1685499920000" secured By XLabs Security www.xlabs.com.br content-type image/svg+xml accept-ranges bytes content-length 6640
GET H2	200	jquery-3.4.1.min.js Show response smith.armor.zone/scripts/ Frame 6ECC	86 KB 35 KB	176ms 176ms	Script application/javascript	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/scripts/jquery-3.4.1.min.js Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"88145-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:44:03 GMT
GET H2	200	popper.min.js Show response smith.armor.zone/scripts/ Frame 6ECC	21 KB 8 KB	184ms 184ms	Script application/javascript	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/scripts/popper.min.js Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"21257-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:44:03 GMT
GET H2	200	bootstrap-4.4.1.js Show response smith.armor.zone/scripts/ Frame 6ECC	132 KB 34 KB	182ms 182ms	Script application/javascript	34.125.138.136 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://smith.armor.zone/scripts/bootstrap-4.4.1.js Requested by Host: smith.armor.zone URL: https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.125.138.136 Las Vegas, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 136.138.125.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f` Request headers accept-language en-GB,en;q=0.9 Referer https://smith.armor.zone/host_block?host=news.mailclick.me&waf=smith.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:44:03 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"135079-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:44:03 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
news.mailclick.me
smith.armor.zone
104.237.62.211
34.125.138.136
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6
3c0495145f777e181ad57c4fd8dc74148e7269a0be702d067ba61cd15d20dbf5
3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f
78e112f934ea9df2ef270d3da8140b1589cf0dd3baab0f414186f8766d26beee
8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e
a847638b5a0eb232ff14ab8b11b3cbe91e2798003b6bc6006b88c89212edd797
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f

news.mailclick.me Open in urlscan Pro 34.125.138.136 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

123 kBTransfer

448 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

news.mailclick.me Open in urlscan Pro
34.125.138.136 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions