urlscan.io logo urlscan.io
SecurityTrails logo

rigans.com Open in urlscan Pro
37.153.88.212  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Submission: On January 11 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 37.153.88.212, located in Valencia, Spain and belongs to UNELINK, ES. The main domain is rigans.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 28th 2019. Valid for: 3 months.
This is the only time rigans.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 4 37.153.88.212 60494 (UNELINK)
5 95.100.67.47 16625 (AKAMAI-AS)
7 3
Apex Domain
Subdomains		 Transfer
5 typekit.net
use.typekit.net
p.typekit.net
96 KB
4 rigans.com
rigans.com
www.rigans.com
102 KB
7 2
Domain Requested by
4 use.typekit.net rigans.com
use.typekit.net
3 rigans.com 2 redirects
1 p.typekit.net rigans.com
1 www.rigans.com rigans.com
7 4

This site contains no links.

Subject Issuer Validity Valid
rigans.com
Let's Encrypt Authority X3		 2019-11-28 -
2020-02-26		 3 months crt.sh
*.typekit.net
DigiCert SHA2 Secure Server CA		 2019-12-06 -
2021-12-10		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Frame ID: 0E7D03B2FAFEFF41D74F4C6EA406247D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf HTTP 301
    https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

197 kB
Transfer

516 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf HTTP 301
    https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif HTTP 302
  • http://www.rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Redirect Chain
  • https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf
  • https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
374 KB
101 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.153.88.212 Valencia, Spain, ASN60494 (UNELINK, ES),
Reverse DNS
cp02.andromat.net
Software
nginx /
Resource Hash
8ba0af9def5f5e8060a2dfe305bd28c86b42a48523d4df867f18a7e3ad296ba0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
rigans.com
:scheme
https
:path
/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Sat, 11 Jan 2020 12:15:31 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Fri, 10 Jan 2020 15:48:08 GMT
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-nginx-cache-status
EXPIRED
x-server-powered-by
Engintron
content-encoding
gzip

Redirect headers

status
301
server
nginx
date
Sat, 11 Jan 2020 12:15:31 GMT
content-type
text/html; charset=iso-8859-1
content-length
281
location
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-nginx-cache-status
MISS
x-server-powered-by
Engintron
ath5djs.js
use.typekit.net/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/ath5djs.js
Requested by
Host: rigans.com
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1ea40ab24141f710f3f1a789b3156a1ee167218f01245d68ec2386d71236b3ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
access-control-allow-origin
*
date
Sat, 11 Jan 2020 12:15:30 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
status
200
cache-control
public, max-age=600, stale-while-revalidate=604800
timing-allow-origin
*
content-length
7400
squarespinner_2x.gif
www.rigans.com/renga-idprovider/resources/web_v2/img/
Redirect Chain
  • https://rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
  • http://www.rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
Requested by
Host: rigans.com
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
HTTP/1.1
Server
37.153.88.212 Valencia, Spain, ASN60494 (UNELINK, ES),
Reverse DNS
cp02.andromat.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Redirect headers

pragma
public
date
Sat, 11 Jan 2020 12:15:32 GMT
server
nginx
location
http://www.rigans.com/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
content-type
text/html; charset=utf-8
status
302
cache-control
max-age=5184000
content-length
0
expires
Wed, 11 Mar 2020 12:15:32 GMT
truncated
/ 		36 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d4d7467a56ebdf0abdff0bf413f070c236abe05f480147571a329438e28b799d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
l
use.typekit.net/af/cb695f/000000000000000000017701/27/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?subset_id=2&fvd=n4&v=3
Requested by
Host: rigans.com
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8b7eb699aedbbf4d04907b45f4348e6b54119a6567b4b9f1be4943ba80c5af19

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Origin
https://rigans.com

Response headers

date
Sat, 11 Jan 2020 12:15:30 GMT
server
nginx
access-control-allow-origin
*
etag
"fae41ba404dda76663c7e537ab5cab2de69de329"
content-type
application/font-woff2
status
200
cache-control
public, max-age=31536000
timing-allow-origin
*
content-length
29924
l
use.typekit.net/af/eaf09c/000000000000000000017703/27/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=2&fvd=n7&v=3
Requested by
Host: rigans.com
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b97b6df8ca413ee1df0b9cc4dcccbf40bd8539ec54ede0bf9efd06cd94175e04

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Origin
https://rigans.com

Response headers

date
Sat, 11 Jan 2020 12:15:30 GMT
server
nginx
access-control-allow-origin
*
etag
"43c835b2f5dd7a9e7fea805e0e9631e337d18a90"
content-type
application/font-woff2
status
200
cache-control
public, max-age=31536000
timing-allow-origin
*
content-length
29988
l
use.typekit.net/af/40207f/0000000000000000000176ff/27/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?subset_id=2&fvd=n3&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/ath5djs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
683d777e2f11e4a19371359c4bf66b2d0c861aa9a561e6c257a4c49804694e35

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Origin
https://rigans.com

Response headers

date
Sat, 11 Jan 2020 12:15:30 GMT
server
nginx
access-control-allow-origin
*
etag
"fd4970a0ef1a58daf4039ec623a0f43c55c4f6d2"
content-type
application/font-woff2
status
200
cache-control
public, max-age=31536000
timing-allow-origin
*
content-length
29756
p.gif
p.typekit.net/ 		35 B
201 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=ath5djs&ht=tk&h=rigans.com&f=7180.7182.7184&a=1164490&js=1.19.2&app=typekit&e=js&_=1578744930860
Requested by
Host: rigans.com
URL: https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Referer
https://rigans.com/wp/3673879727/adobes/f6d3b49c1b2d4968336a5bd3deaf9eaf/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 12:15:30 GMT
last-modified
Thu, 07 Feb 2019 19:30:27 GMT
server
nginx
access-control-allow-origin
*
etag
"5c5c8753-23"
content-type
image/gif
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
35
expires
Fri, 16 Aug 2019 08:20:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Typekit string| special_day_char function| css_browser_selector function| Visitor function| AppMeasurement function| s_gi function| s_pgicq number| CSSBS number| CSSBS_webkit number| CSSBS_chrome number| CSSBS_mac number| CSSBS_js number| CSSBS_portrait object| html5 object| Modernizr function| yepnope number| s_objectID number| s_giq object| adobeid_only_domains function| FastClick function| getValidatorGroups function| getEnhancedDropdownParent object| components function| _now function| debounce function| $ function| jQuery object| jQuery19105689744041818205 object| IMS object| views

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block