truncated Open in urlscan Pro
Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ggwp.media/contract78pdf.html
Effective URL:
data://truncated
Submission: On February 19 via automatic, source phishtank (February 19th 2017, 9:06:04 am UTC)

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 5 countries across 4 domains to perform 9 HTTP transactions. The main IP is , located in and belongs to . The main domain is truncated.

This is the only time truncated was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	37.140.192.153 37.140.192.153	39134 (UNITEDNET ) (UNITEDNET )
4	23.65.214.241 23.65.214.241	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	139.59.164.59 139.59.164.59	202109 (DIGITALOC...) (DIGITALOCEAN-ASN-2 )
1	2a02:26f0:78:... 2a02:26f0:78:293::20c1	20940 (AKAMAI-ASN1 ) (AKAMAI-ASN1 )
1	52.219.28.21 52.219.28.21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9	6

2 37.140.192.153 (Russian Federation)

ASN39134 (UNITEDNET , RU)
PTR: scp59.hosting.reg.ru

ggwp.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.65.214.241 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-65-214-241.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.59.164.59 (London, United Kingdom)

ASN202109 (DIGITALOCEAN-ASN-2 , GB)
PTR: onlinesupport.co.uk

onlinesupport.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:78:293::20c1 (European Union)

ASN20940 (AKAMAI-ASN1 , US)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.219.28.21 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-us-west-1.amazonaws.com

s3-us-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	typekit.net use.typekit.net p.typekit.net	96 KB
2	ggwp.media ggwp.media	145 KB
1	amazonaws.com s3-us-west-1.amazonaws.com	290 B
1	onlinesupport.co.uk onlinesupport.co.uk	53 KB
9	4

	Domain	Requested by
4	use.typekit.net	text use.typekit.net
2	ggwp.media	text
1	s3-us-west-1.amazonaws.com
1	p.typekit.net	ggwp.media
1	onlinesupport.co.uk	text
9	5

This site contains no links.

Subject Issuer	Validity	Valid
typekit.net Symantec Class 3 Secure Server CA - G4	`2016-05-10` - `2017-05-10`	a year	crt.sh
onlinesupport.co.uk Let's Encrypt Authority X3	`2017-01-20` - `2017-04-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: data://truncated
Frame ID: 337.1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ggwp.media/contract78pdf.html Page URL
data://truncated Page URL

Page Statistics

9
Requests

67 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

6
IPs

5
Countries

295 kB
Transfer

788 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ggwp.media/contract78pdf.html Page URL
data://truncated Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 3

http://www.onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png
https://onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png

9 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK contract78pdf.html Show response
ggwp.media/ 352 KB
144 KB 185ms
73ms Document
text/html 37.140.192.153
UNITEDNET

General

Check archive.org

Show headers Download Go to

Full URL: http://ggwp.media/contract78pdf.html
Protocol: HTTP/1.1
Server: 37.140.192.153 , Russian Federation, ASN39134 (UNITEDNET , RU),
Reverse DNS: scp59.hosting.reg.ru
Software: nginx/1.10.2 /
Resource Hash: f26835b8e729549e2ffd2784a612f52ac35f8fcdfe13b4c3d20cf937deabea9f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: ggwp.media
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Sun, 19 Feb 2017 09:05:56 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18 Jan 2017 14:24:17 GMT
Server: nginx/1.10.2
ETag: W/"17a2321-57ea1-5465f2c033133"
Transfer-Encoding: chunked
Content-Type: text/html
Connection: keep-alive

GET
DATA 200
OK Primary Request truncated Show response
/ 264 KB
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 944fc6b5a6694048073b62319a50681b8c29348bee9434705d7af4f2114b8ca0

Request headers

Upgrade-Insecure-Requests: 1
Referer: http://ggwp.media/contract78pdf.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Content-Type: text/html;charset=US-ASCII

GET
H/1.1 404
Not Found favicon.ico
ggwp.media/ 3 KB
1 KB 82ms
81ms Other
text/html 37.140.192.153
UNITEDNET

General

Check archive.org

Show headers Download Go to

Full URL: http://ggwp.media/favicon.ico
Requested by: Host: text
URL: data:text/html;truncated
Protocol: HTTP/1.1
Server: 37.140.192.153 , Russian Federation, ASN39134 (UNITEDNET , RU),
Reverse DNS: scp59.hosting.reg.ru
Software: nginx/1.10.2 /
Resource Hash: 425fb249ae716a54e9c4af0fcf64bebd0c8bb2a79937e80e2d79855384f6ddff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: ggwp.media
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Sun, 19 Feb 2017 09:05:57 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 Jan 2017 12:46:26 GMT
Server: nginx/1.10.2
ETag: W/"3fe0893-b34-545d0fd2a2930"
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 ath5djs.js Show response
use.typekit.net/ 18 KB
8 KB 24ms
7ms Script
text/javascript 23.65.214.241
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/ath5djs.js

Requested by

Host: text
URL: data:text/html;truncated

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.65.214.241 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-65-214-241.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e0f4c1d046d68053ddc2cf58080825c670b11d8f82b504111d4863b29af3b256

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

:path: /ath5djs.js
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: use.typekit.net
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
vary: Accept-Encoding
server: nginx
date: Sun, 19 Feb 2017 09:05:57 GMT
status: 200 200 OK
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-length: 7719

GET
H/1.1

200
OK

ACP_PDF-2_file_document.png
onlinesupport.co.uk/wp-content/uploads/2015/01/
Redirect Chain

http://www.onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png
https://onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png

53 KB
53 KB

111ms
34ms

Image
image/png

139.59.164.59
DIGITALOCEAN-ASN-2

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png

Requested by

Host: text
URL: data:text/html;truncated

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.59.164.59 London, United Kingdom, ASN202109 (DIGITALOCEAN-ASN-2 , GB),

Reverse DNS

onlinesupport.co.uk

Software

nginx /

Resource Hash

1a663dd53e8163b9299a6ffa00b77a618058b6c57fad4cc1eb5fac36fb449909

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.google-analytics.com https://.googleapis.com https://.gstatic.com https://.gravatar.com https://*.w.org data: 'unsafe-inline' 'unsafe-eval';
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: onlinesupport.co.uk
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Sun, 19 Feb 2017 09:05:57 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 16 May 2016 16:19:04 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN
ETag: "5739f2f8-d4af"
Strict-Transport-Security: max-age=31536000; includeSubdomains
Content-Type: image/png
Cache-Control: max-age=31536000
Content-Security-Policy: default-src 'self' https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.gravatar.com https://*.w.org data: 'unsafe-inline' 'unsafe-eval';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 54447
X-Xss-Protection: 1; mode=block
Expires: Mon, 19 Feb 2018 09:05:57 GMT

Redirect headers

Content-Security-Policy: default-src 'self' https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.gravatar.com https://*.w.org data: 'unsafe-inline' 'unsafe-eval';
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Date: Sun, 19 Feb 2017 09:05:57 GMT
Strict-Transport-Security: max-age=31536000; includeSubdomains
Content-Type: text/html
Location: https://onlinesupport.co.uk/wp-content/uploads/2015/01/ACP_PDF-2_file_document.png
Connection: keep-alive
Content-Length: 178
X-Xss-Protection: 1; mode=block

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc

Request headers

Response headers

GET
H2 200 l
use.typekit.net/af/55f25a/0000000000000000000176ff/27/ 29 KB
29 KB 21ms
6ms Font
application/font-woff2 23.65.214.241
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/55f25a/0000000000000000000176ff/27/l?subset_id=2&fvd=n3&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
Requested by: Host: text
URL: data:text/html;truncated
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.65.214.241 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-65-214-241.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ecc478d9b8bc066c57635731c6788d8a7f448a9afc65ff367b38f2e7d2c84933

Request headers

:path: /af/55f25a/0000000000000000000176ff/27/l?subset_id=2&fvd=n3&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
pragma: no-cache
origin: null
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: use.typekit.net
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Origin: null

Response headers

date: Sun, 19 Feb 2017 09:05:57 GMT
server: nginx
etag: "fd4970a0ef1a58daf4039ec623a0f43c55c4f6d2"
status: 200 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 29876

GET
H2 200 l
use.typekit.net/af/f45851/000000000000000000017701/27/ 29 KB
29 KB 15ms
10ms Font
application/font-woff2 23.65.214.241
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f45851/000000000000000000017701/27/l?subset_id=2&fvd=n4&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
Requested by: Host: text
URL: data:text/html;truncated
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.65.214.241 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-65-214-241.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 3d2a8ced941fdf6b74806c530dd5df4a3738863ce75395bf36a6aac9f6654199

Request headers

:path: /af/f45851/000000000000000000017701/27/l?subset_id=2&fvd=n4&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
pragma: no-cache
origin: null
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: use.typekit.net
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Origin: null

Response headers

date: Sun, 19 Feb 2017 09:05:57 GMT
server: nginx
etag: "fae41ba404dda76663c7e537ab5cab2de69de329"
status: 200 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 30056

GET
H2 200 l
use.typekit.net/af/73d558/000000000000000000017703/27/ 29 KB
30 KB 9ms
9ms Font
application/font-woff2 23.65.214.241
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/73d558/000000000000000000017703/27/l?subset_id=2&fvd=n7&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/ath5djs.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.65.214.241 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-65-214-241.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ffc069a4ec68573fbf4f5e3bb1333b3ee6c5c03381c31917fe519e8db81856bd

Request headers

:path: /af/73d558/000000000000000000017703/27/l?subset_id=2&fvd=n7&token=Hik3Pm6JnhEwLxQ0zehfgP7DFQJ1vuM7QdmfPvgMUw64jjV9LtjIZ8IrzWWxRdE7Ea7uXFY0TehNVReHgFPgv8jW1U00uHWtuTUbmQXN194Km4P65eavootjMUavRSqRMCOthtiT7%2FcuCNyJHkHS89Lwr3Ih%2BUM0eVYPL%2FdPhIYnpUtzXE9Z9ELLbvlbfwv8V6TTp%2FRhNMNelhreul%2B4cA%3D%3D
pragma: no-cache
origin: null
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: use.typekit.net
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Origin: null

Response headers

date: Sun, 19 Feb 2017 09:05:57 GMT
server: nginx
etag: "43c835b2f5dd7a9e7fea805e0e9631e337d18a90"
status: 200 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 30136

GET
H/1.1 200
OK p.gif
p.typekit.net/ 35 B
35 B 21ms
6ms Image
image/gif 2a02:26f0:78:293::20c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=ath5djs&app=typekit&ht=tk&f=7180.7182.7184&a=1164490&js=1.18.13&_=1487495157389
Requested by: Host: ggwp.media
URL: http://ggwp.media/contract78pdf.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:78:293::20c1 , European Union, ASN20940 (AKAMAI-ASN1 , US),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: p.typekit.net
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Sun, 19 Feb 2017 09:05:57 GMT
Last-Modified: Mon, 20 Jun 2016 13:48:48 GMT
Server: nginx
ETag: "5767f440-23"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35
Expires: Tue, 28 Jun 2016 09:10:32 GMT

GET
H/1.1 403
Forbidden adobe.com.ico
s3-us-west-1.amazonaws.com/dobe/images/ 278 B
290 B 349ms
178ms Other
application/xml 52.219.28.21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://s3-us-west-1.amazonaws.com/dobe/images/adobe.com.ico
Protocol: HTTP/1.1
Server: 52.219.28.21 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-us-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 402a630ccc32d260ea29c3a3d6f9431cab4e9081694e35e0a42643991dd5ce19

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: s3-us-west-1.amazonaws.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Sun, 19 Feb 2017 09:05:57 GMT
Server: AmazonS3
x-amz-request-id: 37A798FC43C2D997
Transfer-Encoding: chunked
x-amz-id-2: iDI5RX8kip1wxfPXomrm5wimiEjV0Q9Q9m4JrSJdvo0NTOR74/1SOsIszDFr75Jmf23sNrWBLnE=
Content-Type: application/xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ggwp.media
onlinesupport.co.uk
p.typekit.net
s3-us-west-1.amazonaws.com
use.typekit.net
139.59.164.59
23.65.214.241
2a02:26f0:78:293::20c1
37.140.192.153
52.219.28.21
0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc
1a663dd53e8163b9299a6ffa00b77a618058b6c57fad4cc1eb5fac36fb449909
3d2a8ced941fdf6b74806c530dd5df4a3738863ce75395bf36a6aac9f6654199
402a630ccc32d260ea29c3a3d6f9431cab4e9081694e35e0a42643991dd5ce19
425fb249ae716a54e9c4af0fcf64bebd0c8bb2a79937e80e2d79855384f6ddff
944fc6b5a6694048073b62319a50681b8c29348bee9434705d7af4f2114b8ca0
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
e0f4c1d046d68053ddc2cf58080825c670b11d8f82b504111d4863b29af3b256
ecc478d9b8bc066c57635731c6788d8a7f448a9afc65ff367b38f2e7d2c84933
f26835b8e729549e2ffd2784a612f52ac35f8fcdfe13b4c3d20cf937deabea9f
ffc069a4ec68573fbf4f5e3bb1333b3ee6c5c03381c31917fe519e8db81856bd

truncated Open in urlscan Pro Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

9 Requests

67 %HTTPS

20 %IPv6

4 Domains

5 Subdomains

6 IPs

5 Countries

295 kBTransfer

788 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

truncated Open in urlscan Pro
Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

67 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

6
IPs

5
Countries

295 kB
Transfer

788 kB
Size

0
Cookies

9 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!