![](/screenshots/dc6c58b4-0e78-487f-8472-bc3940602672.png)
eslemployer.com
Open in
urlscan Pro
104.28.6.16
Malicious Activity!
Public Scan
Submission: On April 06 via automatic, source openphish
Summary
This is the only time eslemployer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 104.28.6.16 104.28.6.16 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 104.28.7.16 104.28.7.16 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 172.217.16.206 172.217.16.206 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
11 | 3 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
eslemployer.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
eslemployer.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s08-in-f206.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
eslemployer.com
eslemployer.com |
324 KB |
2 |
google-analytics.com
www.google-analytics.com |
14 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | eslemployer.com |
eslemployer.com
|
2 | www.google-analytics.com |
eslemployer.com
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/
Frame ID: 3C01FBEEAA671CCC849168E924D7BA94
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/dc6c58b4-0e78-487f-8472-bc3940602672.png)
Detected technologies
Detected patterns
- headers server /cloudflare/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- http://www.google-analytics.com/analytics.js HTTP 307
- https://www.google-analytics.com/analytics.js
- http://www.google-analytics.com/r/collect?v=1&_v=j66&a=892015160&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Froundcube%2Fmail%2Fwamp%2Fdom%2Fbropbox%2FDropBox%2F&ul=en-us&de=windows-1252&dt=View%20Document%20-%20Sign%20In&sd=24-bit&sr=1600x1200&vp=1585x1185&je=0&_u=IEBAAEAB~&jid=1611710904&gjid=1901876346&cid=390168444.1523005488&tid=UA-46867713-1&_gid=2027127467.1523005488&_r=1&z=1567674651 HTTP 307
- https://www.google-analytics.com/r/collect?v=1&_v=j66&a=892015160&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Froundcube%2Fmail%2Fwamp%2Fdom%2Fbropbox%2FDropBox%2F&ul=en-us&de=windows-1252&dt=View%20Document%20-%20Sign%20In&sd=24-bit&sr=1600x1200&vp=1585x1185&je=0&_u=IEBAAEAB~&jid=1611710904&gjid=1901876346&cid=390168444.1523005488&tid=UA-46867713-1&_gid=2027127467.1523005488&_r=1&z=1567674651
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
![]() eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/ |
2 KB 1004 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c2kgMt9ja9bXu62fLkR6YuL9eyA.js
eslemployer.com/cdn-cgi/apps/head/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
officelogo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
googlelogo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlooklogo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aollogo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
919 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoologo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
weblogo.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
583 B 950 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ Redirect Chain
|
35 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background2.png
eslemployer.com/roundcube/mail/wamp/dom/bropbox/DropBox/images/ |
297 KB 297 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
www.google-analytics.com/r/ Redirect Chain
|
35 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| Eager object| CloudflareApps string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.eslemployer.com/ | Name: _gid Value: GA1.2.2027127467.1523005488 |
|
.eslemployer.com/ | Name: _ga Value: GA1.2.390168444.1523005488 |
|
.eslemployer.com/ | Name: _gat Value: 1 |
|
.eslemployer.com/ | Name: __cfduid Value: d5f171a57ce60f29f1b1260c89aa4335f1523005487 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eslemployer.com
www.google-analytics.com
104.28.6.16
104.28.7.16
172.217.16.206
010da445e8c3df9019ed05532d7caaa0879eaef62761289bca71f93782fe9d56
19dcc4f189dbc6b7d5c7745b26a153c5f38b263bea0dca4fd9f68791d77caefa
23aca544a446faecf38992ab165a42e26b48d2bcc3bb1b3944aae583dd36f85c
33cf2383e9a88578a6e92a30db80f030773d28055b6e7008a849ac7f8c8acb0a
47d4e3ecf486cf9e611f4efd0ee3fb1353bad7b78e49310168ba5e5102b1de33
5536cdcf45ed63ad03a3214f532bfd01364f8f016b31c019959080e753aeed36
554bb7b59a3ea1243bfa5b684ca0d2fe8df727d1e7007f1e1c0a5afd995516a2
8320eb4c1affe6792fc5f10112374bed5b69853a96a78f33b264d3f656e0f08a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
cc24debf9d79093a460a612307ec96603d1b3877319f1242c3eb175565f42787
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7