Submitted URL: http://u8042263.ct.sendgrid.net/ls/click?upn=GPF2gsTHza-2FC56b1W9YEaLBXG-2Fyv2mPQtH5R27bedeZmZhBbAPp0ks6NfJoI9nuW52DFHScLfZBZ0L9A7S-2F5xufoZhUv-2BglXmfHxKLA6DewqWtlfFXysmU-2FzHydp4TGVX7dlcrf7QGpmSdKfL5xiHJx1wOJFF2cpjp19EliBVOc-3DlzbD_YX7osDPrGAo-2BwS6yNs-2FdcEhYbS7aVukQZd-2B9Q-2BAxo-2F3HsN2rs2VGckEXPyfe7TCZvNX2HTQE-2Fq78a-2Fu-2F1DTrNVk-2FlbfY4-2BEWeWmEuq0pBQVAdSUKOKhj-2FHtNX-2FNh73fe8VLQHtog1WEj7-2BBnj-2FvW-2BYvfxjDdwxmdfiziOpkOrHAZcRRZhxXgM4clVWy7-2BsbcbrlhEh3FljiY-2Fm-2F1lMZ0KsssytPfBToX4UBDcuWO688-3D
Effective URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Submission: On June 30 via manual from IN

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2a00:1450:4001:816::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com.
TLS certificate: Issued by GTS CA 1O1 on June 17th 2020. Valid for: 3 months.
This is the only time vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.16 11377 (SENDGRID)
1 2a00:1450:400... 15169 (GOOGLE)
4 160.153.53.104 26496 (AS-26496-...)
6 3
Domain
Subdomains
Transfer
4 adkpd.com
.adkpd.com Failed
6 KB
1 r.appspot.com
155 KB
1 sendgrid.net
308 B
6 3
Domain Requested by
4 adkpd.com vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com

1 vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
1 u8042263.ct.sendgrid.net 1 redirects
6 3

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
*.appspot.com
GTS CA 1O1
2020-06-17 -
2020-09-09
3 months
adkpd.com
ZeroSSL RSA Domain Secure Site CA
2020-05-08 -
2020-08-06
3 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /Google Frontend/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/

Redirect Chain
  • http://u8042263.ct.sendgrid.net/ls/click?upn=GPF2gsTHza-2FC56b1W9YEaLBXG-2Fyv2mPQtH5R27bedeZmZhBbAPp0ks6NfJoI9nuW52DFHScLfZBZ0L9A7S-2F5xufoZhUv-2BglXmfHxKLA6DewqWtlfFXysmU-2FzHydp4TGVX7dlcrf7QGpmSd...
  • https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
225 KB
155 KB
Document
General
Full URL
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
49910c68e536af7b7e9a3518ac15c49f8ccfe4f76e9fed75b743e5e43652e7e8

Request headers

:method
GET
:authority
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
content-type
text/html
content-encoding
gzip
x-cloud-trace-context
2c69f047c98215ddd36a331096d01e63
vary
Accept-Encoding
date
Tue, 30 Jun 2020 21:52:23 GMT
server
Google Frontend
cache-control
private
content-length
158197
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Server
nginx
Date
Tue, 30 Jun 2020 21:52:22 GMT
Content-Type
text/html; charset=utf-8
Content-Length
127
Connection
keep-alive
Location
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/#Pat.Burke@Downergroup.Com
X-Robots-Tag
noindex, nofollow
fonts.css
adkpd.com/ob/media//css
594 B
337 B
Stylesheet
General
Full URL
https://adkpd.com/ob/media//css/fonts.css
Requested by
Host: vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
49705cc2f1777d040b0293f2192443f24c82b61b2962b7c00a3e22d1ec8a4066

Request headers

Referer
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 21:52:23 GMT
content-encoding
gzip
last-modified
Wed, 13 May 2020 02:35:54 GMT
server
Apache
etag
"5a02bc-252-5a57e7069d680-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
188
style.css
adkpd.com/ob/media//css
9 KB
2 KB
Stylesheet
General
Full URL
https://adkpd.com/ob/media//css/style.css
Requested by
Host: vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
96ef5524fc0613f15738e1acc4010d6d34b05b6c0b6d815095109c9ec595ad41

Request headers

Referer
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 21:52:23 GMT
content-encoding
gzip
last-modified
Wed, 13 May 2020 02:35:54 GMT
server
Apache
etag
"5a02bb-2556-5a57e7069d680-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
2132
helpers.js?ver=12839297292
adkpd.com/ob/media//js
11 KB
3 KB
Script
General
Full URL
https://adkpd.com/ob/media//js/helpers.js?ver=12839297292
Requested by
Host: vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
c38d76da3da3c7c8b704f8a11daa64929f65884becfc2a79a1e909d6378686de

Request headers

Referer
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 21:52:23 GMT
content-encoding
gzip
last-modified
Wed, 13 May 2020 02:35:54 GMT
server
Apache
etag
"5a02be-2ad2-5a57e7069d680-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
2652
app.js?ver=21313
adkpd.com/ob/media//js
1 KB
604 B
Script
General
Full URL
https://adkpd.com/ob/media//js/app.js?ver=21313
Requested by
Host: vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
0f064b85d872f5bb47211acb9576741248eac8504bca29773c57e7255175aea9

Request headers

Referer
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 21:52:23 GMT
content-encoding
gzip
last-modified
Wed, 13 May 2020 02:35:54 GMT
server
Apache
etag
"5a02bf-572-5a57e7069d680-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
528
data:truncated
data:truncated
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
106 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b491e2211f7003c16a9132d78a95753e0315bf30b1977518d65e3a76dccec20

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/gif
segoeui-regular.ttf
adkpd.com/ob/media//fonts
0
0

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 0
  • http://u8042263.ct.sendgrid.net/ls/click?upn=GPF2gsTHza-2FC56b1W9YEaLBXG-2Fyv2mPQtH5R27bedeZmZhBbAPp0ks6NfJoI9nuW52DFHScLfZBZ0L9A7S-2F5xufoZhUv-2BglXmfHxKLA6DewqWtlfFXysmU-2FzHydp4TGVX7dlcrf7QGpmSd...
  • https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
adkpd.com
URL
https://adkpd.com/ob/media//fonts/segoeui-regular.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| LIB_phrase string| LIB_view string| ____media string| ____b string| ____rdr object| d object| s function| bindElements function| validateEmail function| getUrlParameter function| dDOM object| Base64 number| LIB_submitTrial function| initForLogin function| initForTrueLogin function| loginUser function| trueLoginUser function| initApp function| sendPost function| sendGet function| bindXhr object| isMobile number| c2 number| c1 object| LIB_submitButton object| LIB_userInput object| LIB_pwdInput object| LIB_spinner function| LIB_beforeSend function| LIB_onComplete

0 Cookies