image.msmail.morganstanley.com Open in urlscan Pro
2a02:26f0:480:36::212:4017 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.msmail.morganstanley.com/?qs=87d5c44049d5e0b309ce4fabef277ebf94bb2566eb71f5c7e0a9bfd8e6a956766b7cadb5dbda557c401951493882...
Effective URL:
https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf
Submission: On March 26 via api (March 26th 2024, 9:50:11 pm UTC) from US — Scanned from DE

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 1 domains to perform 2 HTTP transactions. The main IP is 2a02:26f0:480:36::212:4017, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is image.msmail.morganstanley.com. The Cisco Umbrella rank of the primary domain is 936861.
TLS certificate: Issued by DigiCert Global G3 TLS ECC SHA384 202... on October 23rd 2023. Valid for: a year.

This is the only time image.msmail.morganstanley.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.90.115 13.111.90.115	14340 (SALESFORCE) (SALESFORCE)
2	2a02:26f0:480... 2a02:26f0:480:36::212:4017	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	1

1 13.111.90.115 (United States) 1 redirects

ASN14340 (SALESFORCE, US)
PTR: click.msmail.morganstanley.com

click.msmail.morganstanley.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:36::212:4017 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

image.msmail.morganstanley.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	morganstanley.com 1 redirects click.msmail.morganstanley.com — Cisco Umbrella Rank: 738673 image.msmail.morganstanley.com — Cisco Umbrella Rank: 936861	1 KB
2	1

	Domain	Requested by
2	image.msmail.morganstanley.com
1	click.msmail.morganstanley.com	1 redirects
2	2

This site contains no links.

Subject Issuer	Validity	Valid
akamai-san164.exacttarget.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf
Frame ID: B3EE10DB96F759F293C68903F6B245AB
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://click.msmail.morganstanley.com/?qs=87d5c44049d5e0b309ce4fabef277ebf94bb2566eb71f5c7e0a9bfd8e6a956766b7cadb5... HTTP 302
https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf Page URL

Detected technologies

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

1
IPs

2
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.msmail.morganstanley.com/?qs=87d5c44049d5e0b309ce4fabef277ebf94bb2566eb71f5c7e0a9bfd8e6a956766b7cadb5dbda557c40195149388283537efef4792afef457 HTTP 302
https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf Show response image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/ Redirect Chain https://click.msmail.morganstanley.com/?qs=87d5c44049d5e0b309ce4fabef277ebf94bb2566eb71f5c7e0a9bfd8e6a956766b7cadb5dbda557c40195149388283537efef4792afef457 https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf	345 B 0	1005ms 922ms	Document application/pdf	2a02:26f0:480:36::212:4017 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:36::212:4017 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash `ecd3eda69ba2957846e0c48414498180a161120d26dfaeeb95b813b116a8fc27` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language de-DE,de;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes Cache-Control max-age=600, s-maxage=600, must-revalidate Connection keep-alive Content-Length 405464 Content-Type application/pdf Date Tue, 26 Mar 2024 21:50:06 GMT ETag "b15ad6f9d2a2112eaf37914e12ad89bb:1700514688.101283" Last-Modified Mon, 20 Nov 2023 21:11:28 GMT Server AkamaiNetStorage Redirect headers Cache-Control private Connection close Content-Length 223 Content-Type text/html; charset=utf-8 Date Tue, 26 Mar 2024 21:50:05 GMT Location https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf
GET H/1.1	403 Forbidden	favicon.ico image.msmail.morganstanley.com/	299 B 1 KB	469ms 427ms	Other text/html	2a02:26f0:480:36::212:4017 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://image.msmail.morganstanley.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:36::212:4017 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiGHost / Resource Hash `f95b4e59146f5ea7545d1b037bc4ce10390ac8f76ff000104b33b3d8138e763e` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://image.msmail.morganstanley.com/lib/fe9413737562077971/m/1/2ae3f4a0-ba08-47f9-a493-e13fdc5efbd5.pdf accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Content-Type text/html Date Tue, 26 Mar 2024 21:50:07 GMT Server AkamaiGHost Connection keep-alive Mime-Version 1.0 Content-Length 299 Expires Tue, 26 Mar 2024 21:50:07 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onpagereveal

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.msmail.morganstanley.com/	1970-01-20 19:24:57	Name: ak_bmsc Value: 6965B99CD823052BB0C504867AD52FEB~000000000000000000000000000000~YAAQV7MUArWtNy6OAQAA2/K9fBdO2CrUFL/VKiE8qCvZHz6+xhn6lheyxDrbWfZ5z+9jyjjgINPm2SUqQz4oi2sFItdbLRQBp5eAhovCmqxngdququ075a9SDIhm2Zzxx7Y/PCqKejyxOfDVanjcV6u90knJC3b2q2ksm6zf86LBM2cpatACn+F1sIcsEQs7+l7aKX/ZDeBL1nKViSmI3RIcsZTdMbUs04Q3P5zh8f31ol7/t736bvyzvROFTkrhbLw5rMdNlRYsOUzj9I0Ik5LSf4/7Lt9IuVuJ2d2YKCXf2QcjxG6eXkWX7QkjkVmSXMASiV50B7UnpkfUuqNB9Zn6djwtVnQ9/hHD5q/4E/fzMu7a2sVIjf9ztVmBom4+tn0cISC6Ur+Z7KVwlwmH6hzVqoibCQ1PLw==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://image.msmail.morganstanley.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

click.msmail.morganstanley.com
image.msmail.morganstanley.com
13.111.90.115
2a02:26f0:480:36::212:4017
ecd3eda69ba2957846e0c48414498180a161120d26dfaeeb95b813b116a8fc27
f95b4e59146f5ea7545d1b037bc4ce10390ac8f76ff000104b33b3d8138e763e

image.msmail.morganstanley.com Open in urlscan Pro 2a02:26f0:480:36::212:4017 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

50 %IPv6

1 Domains

2 Subdomains

1 IPs

2 Countries

1 kBTransfer

1 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

image.msmail.morganstanley.com Open in urlscan Pro
2a02:26f0:480:36::212:4017 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

1
IPs

2
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions