watsonxxlake.ga Open in urlscan Pro
2606:4700:30::681f:5c50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Submission: On December 05 via automatic, source openphish (December 5th 2018, 3:53:52 pm UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:30::681f:5c50, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is watsonxxlake.ga.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 4th 2018. Valid for: a year.

This is the only time watsonxxlake.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
6	2606:4700:30:... 2606:4700:30::681f:5c50	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2620:11a:e002... 2620:11a:e002:fa00::204	22300 (WIKIA) (WIKIA - Wikia)
1 2	172.82.236.67 172.82.236.67	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
8	4

6 2606:4700:30::681f:5c50 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

watsonxxlake.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:11a:e002:fa00::204 (United States)

ASN22300 (WIKIA - Wikia, Inc., US)

img4.wikia.nocookie.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.82.236.67 (Lehi, United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: adobe.com.ssl.d1.sc.omtrdc.net

sstats.adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	watsonxxlake.ga watsonxxlake.ga	98 KB
2	adobe.com 1 redirects sstats.adobe.com	2 KB
1	nocookie.net img4.wikia.nocookie.net	8 KB
8	3

	Domain	Requested by
6	watsonxxlake.ga	watsonxxlake.ga
2	sstats.adobe.com	1 redirects watsonxxlake.ga
1	img4.wikia.nocookie.net	watsonxxlake.ga
8	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2018-12-04` - `2019-12-04`	a year	crt.sh
sstats.adobe.com DigiCert SHA2 High Assurance Server CA	`2018-04-03` - `2019-06-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Frame ID: 1855BA3C58D120360C53D0B938A75CE7
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^s_(?:account|objectID|code|INST)$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

8
Requests

88 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

108 kB
Transfer

274 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08A7C118F1-153217E8EF0F814E&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=https%3A%2F%2Fwatsonxxlake.ga%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobee%2Fadobe.php&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&pccr=true&vidn=2E03FA400531210F-400001064002065F&&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08A7C118F1-153217E8EF0F814E&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=https%3A%2F%2Fwatsonxxlake.ga%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobee%2Fadobe.php&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

8 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request adobe.php Show response
watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/ 255 KB
98 KB 277ms
249ms Document
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cd3ed92149d06e8fee2cd5fe27be2968d517e71fff9bc2c35b576de70c87b27

Request headers

:method: GET
:authority: watsonxxlake.ga
:scheme: https
:path: /adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Wed, 05 Dec 2018 15:53:36 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215; expires=Thu, 05-Dec-19 15:53:35 GMT; path=/; domain=.watsonxxlake.ga; HttpOnly; Secure
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4847afbfab63beb7-FRA
content-encoding: gzip

GET
H2 404 ath5djs.htm
watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ 0
0 247ms
247ms Script
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ath5djs.htm
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ath5djs.htm
pragma: no-cache
cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: watsonxxlake.ga
referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
:scheme: https
:method: GET
Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Wed, 05 Dec 2018 15:53:36 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 4847afc2bdefbeb7-FRA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/html; charset=iso-8859-1

GET
H2 404 d_002.htm
watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ 0
0 248ms
248ms Stylesheet
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d_002.htm
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d_002.htm
pragma: no-cache
cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: watsonxxlake.ga
referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
:scheme: https
:method: GET
Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Wed, 05 Dec 2018 15:53:36 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 4847afc2bdf0beb7-FRA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/html; charset=iso-8859-1

GET
H2 404 d.htm
watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ 0
0 220ms
220ms Stylesheet
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d.htm
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d.htm
pragma: no-cache
cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: watsonxxlake.ga
referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
:scheme: https
:method: GET
Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Wed, 05 Dec 2018 15:53:36 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 4847afc2bdf1beb7-FRA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Adobe_Reader_XI_icon.png
img4.wikia.nocookie.net/__cb20131110012508/logopedia/images/1/1a/ 8 KB
8 KB 25ms
5ms Image
image/webp 2620:11a:e002:fa00::204
Wikia

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img4.wikia.nocookie.net/__cb20131110012508/logopedia/images/1/1a/Adobe_Reader_XI_icon.png
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: HTTP/1.1
Server: 2620:11a:e002:fa00::204 , United States, ASN22300 (WIKIA - Wikia, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 33ff424618c807e47824ec0da4665b263056b447adc675366d0d16f76068e078

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 05 Dec 2018 15:53:36 GMT
X-Cacheable: YES
Age: 4256643
X-Thumbnailer: Vignette
X-Cache: ORIGIN, HIT
Content-Disposition: inline; filename="Adobe_Reader_XI_icon.webp"; filename*=UTF-8''Adobe_Reader_XI_icon.webp
Connection: keep-alive
X-Surrogate-Key: cc3c3969250a85603dc06324e662f29f84706f5a
Content-Length: 7948
X-Served-By: dfs-s6, wk-cdn-f3
Surrogate-Key: cc3c3969250a85603dc06324e662f29f84706f5a
Server: nginx
ETag: "00f9c6ef9ee5032ab2a56c79b8d0231a"
Vary: Accept
Content-Type: image/webp
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Cache-Hits: ORIGIN, 31

GET
H2 404 d.htm
watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/ 0
0 115ms
115ms Stylesheet
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d.htm
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /adobeenew/adobeenew/adobeenew/adobeenew/adobee/Sign%20in%20-%20Adobe%20Files_files/d.htm
pragma: no-cache
cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: watsonxxlake.ga
referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
:scheme: https
:method: GET
Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Wed, 05 Dec 2018 15:53:36 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 4847afc44f68beb7-FRA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

s57490956133751
sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/
Redirect Chain

https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08A7C118F1-153217E8EF0F814E&ce=UTF-8&ns=adobecorp&pa...
https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&pccr=true&vidn=2E03FA400531210F-400001064002065F&&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08...

43 B
719 B

34ms
33ms

Image
image/gif

172.82.236.67
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&pccr=true&vidn=2E03FA400531210F-400001064002065F&&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08A7C118F1-153217E8EF0F814E&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=https%3A%2F%2Fwatsonxxlake.ga%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobee%2Fadobe.php&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.82.236.67 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),

Reverse DNS

adobe.com.ssl.d1.sc.omtrdc.net

Software

Omniture DC/2.0.0 /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 05 Dec 2018 15:53:36 GMT
X-Content-Type-Options: nosniff
X-C: ms-6.5.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Thu, 06 Dec 2018 15:53:36 GMT
Server: Omniture DC/2.0.0
xserver: www50
ETag: "3315768903546765312-5207217826758264438"
Vary: *
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Tue, 04 Dec 2018 15:53:36 GMT

Redirect headers

Date: Wed, 05 Dec 2018 15:53:36 GMT
X-Content-Type-Options: nosniff
X-C: ms-6.5.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Thu, 06 Dec 2018 15:53:36 GMT
Server: Omniture DC/2.0.0
xserver: www50
Location: https://sstats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s57490956133751?AQB=1&pccr=true&vidn=2E03FA400531210F-400001064002065F&&ndh=1&t=5%2F11%2F2018%2015%3A53%3A36%203%200&fid=45015B08A7C118F1-153217E8EF0F814E&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=https%3A%2F%2Fwatsonxxlake.ga%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobeenew%2Fadobee%2Fadobe.php&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Tue, 04 Dec 2018 15:53:36 GMT

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H2 404 squarespinner_2x.gif
watsonxxlake.ga/renga-idprovider/resources/web_v2/img/ 375 B
375 B 221ms
221ms Image
text/html 2606:4700:30::681f:5c50
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://watsonxxlake.ga/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
Requested by: Host: watsonxxlake.ga
URL: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681f:5c50 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4403546cef517cb464c7cfa43e4c6170e0e16e35a5879e3aff4bd1b3bd41a6ea

Request headers

:path: /renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
pragma: no-cache
cookie: __cfduid=d8ff3b10a5eb4c0bacac8c1672ec255001544025215; s_fid=45015B08A7C118F1-153217E8EF0F814E; s_cc=true
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: watsonxxlake.ga
referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
:scheme: https
:method: GET
Referer: https://watsonxxlake.ga/adobeenew/adobeenew/adobeenew/adobeenew/adobee/adobe.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 05 Dec 2018 15:53:37 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=iso-8859-1
status: 404
cache-control: public, max-age=14400
cf-ray: 4847afc608f1beb7-FRA
expires: Wed, 05 Dec 2018 19:53:37 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.watsonxxlake.ga/	1969-12-31 23:59:59	Name: s_cc Value: true
.watsonxxlake.ga/	1970-01-20 16:43:11	Name: s_fid Value: 45015B08A7C118F1-153217E8EF0F814E
.watsonxxlake.ga/	1970-01-19 05:39:21	Name: __cfduid Value: d8ff3b10a5eb4c0bacac8c1672ec255001544025215

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img4.wikia.nocookie.net
sstats.adobe.com
watsonxxlake.ga
172.82.236.67
2606:4700:30::681f:5c50
2620:11a:e002:fa00::204
0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc
1cd3ed92149d06e8fee2cd5fe27be2968d517e71fff9bc2c35b576de70c87b27
33ff424618c807e47824ec0da4665b263056b447adc675366d0d16f76068e078
4403546cef517cb464c7cfa43e4c6170e0e16e35a5879e3aff4bd1b3bd41a6ea
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

watsonxxlake.ga Open in urlscan Pro 2606:4700:30::681f:5c50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

108 kBTransfer

274 kBSize

3 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

33 JavaScript Global Variables

3 Cookies

Indicators

watsonxxlake.ga Open in urlscan Pro
2606:4700:30::681f:5c50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

108 kB
Transfer

274 kB
Size

3
Cookies

8 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!