urlscan.io logo urlscan.io
SecurityTrails logo

files.vestwell.com Open in urlscan Pro
2600:9000:2156:da00:17:1715:fe80:93a1  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://z.vestwell.com/t/11400/c/8596c3f8-095f-4db4-b220-9f4e8012aac7/NB2HI4DTHIXS6ZTJNRSXGLTWMVZXI53FNRWC4Y3PNUXWI33XN...
Effective URL: https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041
Submission: On May 08 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 2600:9000:2156:da00:17:1715:fe80:93a1, located in United States and belongs to AMAZON-02, US. The main domain is files.vestwell.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 24th 2023. Valid for: 5 months.
This is the only time files.vestwell.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

3 reasons why starting a company-sponsored retirement plan is more affordable than ever.pdf 2 MB application/pdf
MIME: PDF document, version 1.7
Size: 2 MB (1631429 bytes, 100% done)
Downloaded from: https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041

Domain & IP information

IP Address AS Autonomous System
1 1 54.166.96.114 14618 (AMAZON-AES)
1 1 3.125.145.199 16509 (AMAZON-02)
1 2600:9000:215... 16509 (AMAZON-02)
1 1
Apex Domain
Subdomains		 Transfer
2 vestwell.com
z.vestwell.com
files.vestwell.com
310 B
1 salesloft.com
app.salesloft.com — Cisco Umbrella Rank: 33606
555 B
1 2
Domain Requested by
1 files.vestwell.com
1 app.salesloft.com 1 redirects
1 z.vestwell.com 1 redirects
1 3

This site contains no links.

Subject Issuer Validity Valid
files.vestwell.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-07-26		 5 months crt.sh

This page contains 1 frames:

Primary Page: https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041
Frame ID: 9E76D88CA776CA673908FB9C876A2E06
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

Page Statistics

1
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

1
IPs

2
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request a0caafc68dd311ed8befe29e419d8041
files.vestwell.com/download/
Redirect Chain
  • https://z.vestwell.com/t/11400/c/8596c3f8-095f-4db4-b220-9f4e8012aac7/NB2HI4DTHIXS6ZTJNRSXGLTWMVZXI53FNRWC4Y3PNUXWI33XNZWG6YLEF5QTAY3BMFTGGNRYMRSDGMJRMVSDQYTFMZSTEOLFGQYTSZBYGA2DC===/files-vestwell...
  • https://app.salesloft.com/t/11400/c/8596c3f8-095f-4db4-b220-9f4e8012aac7/NB2HI4DTHIXS6ZTJNRSXGLTWMVZXI53FNRWC4Y3PNUXWI33XNZWG6YLEF5QTAY3BMFTGGNRYMRSDGMJRMVSDQYTFMZSTEOLFGQYTSZBYGA2DC===/files-vestw...
  • https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:da00:17:1715:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-disposition
filename="3 reasons why starting a company-sponsored retirement plan is more affordable than ever.pdf"
content-length
1631429
content-type
application/pdf
date
Mon, 08 May 2023 17:18:23 GMT
etag
"1e97e9ab6aefea0fd3b2636e68d2ea28"
last-modified
Fri, 06 Jan 2023 15:05:59 GMT
server
nginx
server-timing
cdn-upstream-layer;desc="EDGE",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=2,cdn-upstream-fbl;dur=735,cdn-upstream-layer;desc="REC",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=183,cdn-upstream-fbl;dur=494,cdn-cache-miss,cdn-pop;desc="FRA60-P4",cdn-rid;desc="ZT_GwbzHXLYmACVTXQIeiewQZb_RZAwAmjYboJotAt-WLqVPudH6lg==",cdn-downstream-fbl;dur=732,cdn-cache-miss,cdn-pop;desc="FRA50-C1",cdn-rid;desc="U9hcpJSfLfJ4wUuZofqXD5q-hGGes3DKV2nqgk7Qr8WG2kX6vjbzMQ==",cdn-downstream-fbl;dur=739
vary
Accept-Encoding Origin Origin
via
1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront), 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-id
U9hcpJSfLfJ4wUuZofqXD5q-hGGes3DKV2nqgk7Qr8WG2kX6vjbzMQ==
x-amz-cf-pop
FRA60-P4 FRA50-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
JaXKnd8itfyHUWfe62q0ttWFYv3D_fFC
x-cache
Miss from cloudfront

Redirect headers

Cache-Control
no-cache
Connection
keep-alive
Content-Length
134
Content-Type
text/html; charset=utf-8
Date
Mon, 08 May 2023 17:18:22 GMT
Location
https://files.vestwell.com/download/a0caafc68dd311ed8befe29e419d8041
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
Vary
Origin
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Request-Id
4db7aff6a6dbbecb537701774fe340c4
X-Runtime
0.053847
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.salesloft.com
files.vestwell.com
z.vestwell.com
2600:9000:2156:da00:17:1715:fe80:93a1
3.125.145.199
54.166.96.114