sparklan.createsend.com Open in urlscan Pro
13.35.254.105 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/?tx=0&previewAll=1&print=1&sourc...
Submission: On June 18 via manual (June 18th 2020, 5:51:46 pm UTC) from US

Summary HTTP 7 Redirects Links 55 Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 7 HTTP transactions. The main IP is 13.35.254.105, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is sparklan.createsend.com.

This is the only time sparklan.createsend.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	13.35.254.105 13.35.254.105	16509 (AMAZON-02) (AMAZON-02)
1	13.226.154.120 13.226.154.120	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6811:b758	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	143.204.202.129 143.204.202.129	16509 (AMAZON-02) (AMAZON-02)
7	5

1 13.35.254.105 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-254-105.fra6.r.cloudfront.net

sparklan.createsend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.154.120 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-154-120.dus51.r.cloudfront.net

i3.createsend1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:b758 (United States)

ASN13335 (CLOUDFLARENET, US)

createsend1.report-uri.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.129 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-129.fra53.r.cloudfront.net

i1.createsend1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	report-uri.com createsend1.report-uri.com	1 KB
2	createsend1.com i3.createsend1.com i1.createsend1.com	10 KB
1	createsend.com sparklan.createsend.com	10 KB
0	googleapis.com Failed ajax.googleapis.com Failed
7	4

	Domain	Requested by
3	createsend1.report-uri.com	sparklan.createsend.com
1	i1.createsend1.com	sparklan.createsend.com
1	i3.createsend1.com	sparklan.createsend.com
1	sparklan.createsend.com
0	ajax.googleapis.com Failed	sparklan.createsend.com
7	5

This site contains links to these domains. Also see Links.

Domain
sparklan.createsend1.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-07` - `2020-10-09`	6 months	crt.sh

This page contains 1 frames:

Primary Page: http://sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/?tx=0&previewAll=1&print=1&source=PrintPreview&context=BE1559E32AC7F640D744A813E2B67A32
Frame ID: 3B52320C215D2E039D828BF428522CFC
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i

Page Statistics

7
Requests

43 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

21 kB
Transfer

102 kB
Size

0
Cookies

55 Outgoing links

These are links going to different origins than the main page.

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-r/
Title: Copy

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-y/
Title: Twitter 0 tweets

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-j/
Title: Translate

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-t/
Title: English

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-i/
Title: العربية

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-d/
Title: Afrikaans

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-h/
Title: беларуская мова

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-k/
Title: български

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-u/
Title: català

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-o/
Title: 中文（简体）

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-b/
Title: 中文（繁體）

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-n/
Title: Hrvatski

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-p/
Title: Česky

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-x/
Title: Dansk

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-m/
Title: eesti keel

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-c/
Title: Nederlands

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-q/
Title: Suomi

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-a/
Title: Français

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-f/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-z/
Title: Ελληνική

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-v/
Title: हिन्दी

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-e/
Title: Magyar

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-s/
Title: Gaeilge

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-g/
Title: Indonesia

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-w/
Title: íslenska

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-yd/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-yh/
Title: 日本語

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-yk/
Title: ភាសាខ្មែរ

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-yu/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jl/
Title: македонски јазик

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jr/
Title: بهاس ملايو

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jy/
Title: Malti

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jj/
Title: Norsk

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jt/
Title: Polski

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ji/
Title: Português

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jd/
Title: Português - Portugal

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jh/
Title: Română

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-jk/
Title: Русский

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ju/
Title: Español

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tl/
Title: Kiswahili

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tr/
Title: Svenska

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ty/
Title: עברית

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tj/
Title: Lietuvių

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tt/
Title: latviešu

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ti/
Title: slovenčina

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-td/
Title: slovenščina

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-th/
Title: српски

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tk/
Title: தமிழ்

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-tu/
Title: ภาษาไทย

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-il/
Title: Türkçe

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ir/
Title: Filipino

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-iy/
Title: украї́нська

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-ij/
Title: Tiếng Việt

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-l-ptlqty-l-it/
Title: View Here

Search URL Search Domain Scan URL

URL: https://sparklan.createsend1.com/t/t-u-ptlqty-l-l/
Title: unsubscribe instantly

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/ 93 KB
10 KB 368ms
335ms Document
text/html 13.35.254.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

http://sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/?tx=0&previewAll=1&print=1&source=PrintPreview&context=BE1559E32AC7F640D744A813E2B67A32

Protocol

HTTP/1.1

Server

13.35.254.105 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-254-105.fra6.r.cloudfront.net

Software

csw /

Resource Hash

31879dd08dae509d708c10ee14050057e9265025bddc3436c5e9fe53d27c47a0

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' js.createsend1.com https://connect.facebook.net www.google-analytics.com; base-uri 'none'; report-uri https://createsend1.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Host: sparklan.createsend.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: csw
Vary: Accept-Encoding
Cache-Control: private
Content-Encoding: gzip
Content-Security-Policy: script-src 'self' js.createsend1.com https://connect.facebook.net www.google-analytics.com; base-uri 'none'; report-uri https://createsend1.report-uri.com/r/t/csp/enforce;
P3P: CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
Date: Thu, 18 Jun 2020 17:51:28 GMT
X-XSS-Protection: 1;mode=block
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
Referrer-Policy: no-referrer-when-downgrade
X-Cache: Miss from cloudfront
Via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
X-Amz-Cf-Id: fq7ymPnbgi8riwgc1eKMHfmr6VVbdZF7pdqq9-JifIfbzr0geRFjOw==

GET
H/1.1 200
OK ablsnx7_2.png
i3.createsend1.com/ei/t/1E/712/3EF/033117/csimport/ 4 KB
4 KB 151ms
88ms Image
image/png 13.226.154.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://i3.createsend1.com/ei/t/1E/712/3EF/033117/csimport/ablsnx7_2.png

Requested by

Host: sparklan.createsend.com
URL: http://sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/?tx=0&previewAll=1&print=1&source=PrintPreview&context=BE1559E32AC7F640D744A813E2B67A32

Protocol

HTTP/1.1

Server

13.226.154.120 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-154-120.dus51.r.cloudfront.net

Software

csw /

Resource Hash

a1934ad750e71c2824622cc225e9bfa36ea7e3d5de6307ab7edc7823cfc2c45c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: http://sparklan.createsend.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Jun 2020 17:31:20 GMT
Via: 1.1 d0be2eec997f966c9c7eb03ae2f75c30.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1207
X-Cache: Hit from cloudfront
P3P: CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
Connection: keep-alive
Content-Length: 3842
X-XSS-Protection: 1;mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: csw
Content-Type: image/png
Cache-Control: public, max-age=86400
X-Amz-Cf-Pop: DUS51-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: zzKQk_xnEaLRIDj_As40Hlfndv70KZ0FW-pmRS9jazT4h1MbGDtQwg==

POST
H2 201 enforce
createsend1.report-uri.com/r/t/csp/ 0
818 B 110ms
24ms Other
text/plain 2606:4700::6811:b758
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://createsend1.report-uri.com/r/t/csp/enforce

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b758 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: http://sparklan.createsend.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jun 2020 17:51:28 GMT
nel: {"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction":0.00001}
server: cloudflare
status: 201
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"default","max_age":3600,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=63113904; includeSubDomains; preload
cf-ray: 5a56dbcabf9cdff7-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 036a27b2b60000dff74d9c2200000001

POST
H2 201 enforce
createsend1.report-uri.com/r/t/csp/ 0
261 B 115ms
29ms Other
text/plain 2606:4700::6811:b758
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://createsend1.report-uri.com/r/t/csp/enforce

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b758 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: http://sparklan.createsend.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jun 2020 17:51:28 GMT
nel: {"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction":0.00001}
server: cloudflare
status: 201
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"default","max_age":3600,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=63113904; includeSubDomains; preload
cf-ray: 5a56dbcabfa2dff7-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 036a27b2b70000dff74d9c4200000001

GET jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.4.2/ 0
0

POST
H2 201 enforce
createsend1.report-uri.com/r/t/csp/ 0
259 B 112ms
26ms Other
text/plain 2606:4700::6811:b758
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://createsend1.report-uri.com/r/t/csp/enforce

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b758 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: http://sparklan.createsend.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jun 2020 17:51:28 GMT
nel: {"report_to":"default","max_age":3600,"include_subdomains":true,"failure_fraction":0.00001}
server: cloudflare
status: 201
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"default","max_age":3600,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=63113904; includeSubDomains; preload
cf-ray: 5a56dbcabfa6dff7-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 036a27b2b70000dff74d9c5200000001

GET
H/1.1 200
OK hnzmc3w_0.png
i1.createsend1.com/ei/t/1E/712/3EF/033117/csimport/ 5 KB
6 KB 141ms
83ms Image
image/png 143.204.202.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://i1.createsend1.com/ei/t/1E/712/3EF/033117/csimport/hnzmc3w_0.png

Requested by

Protocol

HTTP/1.1

Server

143.204.202.129 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-202-129.fra53.r.cloudfront.net

Software

csw /

Resource Hash

1ec874ea99ca886deef2774e13064ba6b7afbc5163f1e0597ca4359c51b3be60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Request headers

Referer: http://sparklan.createsend.com/t/ViewEmail/t/7A96A0ABCECE69FC2540EF23F30FEDED/C67FD2F38AC4859C/?tx=0&previewAll=1&print=1&source=PrintPreview&context=BE1559E32AC7F640D744A813E2B67A32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 18 Jun 2020 17:31:20 GMT
Via: 1.1 f2db75b601dc30df73b1beb29596a375.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1209
X-Cache: Hit from cloudfront
P3P: CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
Connection: keep-alive
Content-Length: 5312
X-XSS-Protection: 1;mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: csw
Content-Type: image/png
Cache-Control: public, max-age=86400
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: Q1KBoXU1X3w6H1cR9pTDKa5z1tKIn0NZ3ezajpC_F4OggR6_khtrUA==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'self' js.createsend1.com https://connect.facebook.net www.google-analytics.com; base-uri 'none'; report-uri https://createsend1.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
createsend1.report-uri.com
i1.createsend1.com
i3.createsend1.com
sparklan.createsend.com
ajax.googleapis.com
13.226.154.120
13.35.254.105
143.204.202.129
2606:4700::6811:b758
1ec874ea99ca886deef2774e13064ba6b7afbc5163f1e0597ca4359c51b3be60
31879dd08dae509d708c10ee14050057e9265025bddc3436c5e9fe53d27c47a0
a1934ad750e71c2824622cc225e9bfa36ea7e3d5de6307ab7edc7823cfc2c45c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

sparklan.createsend.com Open in urlscan Pro 13.35.254.105 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

43 %HTTPS

25 %IPv6

4 Domains

5 Subdomains

5 IPs

1 Countries

21 kBTransfer

102 kBSize

0 Cookies

55 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

sparklan.createsend.com Open in urlscan Pro
13.35.254.105 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

43 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

21 kB
Transfer

102 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!