comcastlog.formstack.com
Open in
urlscan Pro
13.225.73.94
Malicious Activity!
Public Scan
Submission: On April 16 via api from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 9th 2017. Valid for: 3 years.
This is the only time comcastlog.formstack.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 13.225.73.94 13.225.73.94 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 52.216.250.150 52.216.250.150 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 2 |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-94.fra2.r.cloudfront.net
comcastlog.formstack.com | |
static.formstack.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
formstack.com
comcastlog.formstack.com static.formstack.com |
66 KB |
1 |
amazonaws.com
s3.amazonaws.com |
274 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
5 | static.formstack.com |
comcastlog.formstack.com
|
1 | s3.amazonaws.com |
comcastlog.formstack.com
|
1 | comcastlog.formstack.com | |
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.formstack.com Go Daddy Secure Certificate Authority - G2 |
2017-08-09 - 2020-08-09 |
3 years | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2020-12-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://comcastlog.formstack.com/forms/solve_issues
Frame ID: ED393693D248E9A4638123DE84CF86D2
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Amazon Web Services (PaaS) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Amazon Cloudfront (CDN) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
solve_issues
comcastlog.formstack.com/forms/ |
44 KB 44 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
reset_53bc1bb20a.css
static.formstack.com/forms/css/3/ |
2 KB 837 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui_61ec43d7ce.css
static.formstack.com/forms/css/3/ |
32 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default-v4_f1d5918f48.css
static.formstack.com/forms/css/3/ |
38 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uil-static.css
static.formstack.com/common/css/ |
47 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dialogs_00a7ec5f05.css
static.formstack.com/forms/css/common/ |
170 B 486 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
544904_tmpl_back_5e97c44c55148.
s3.amazonaws.com/files.formstack.com/public/915688/ |
273 KB 274 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
comcastlog.formstack.com
s3.amazonaws.com
static.formstack.com
13.225.73.94
52.216.250.150
013ae83ed71f018b91ae07c0531f5ef432a50c5e46b07fcbf7fae83d892bb4a9
1267297331789466a3f40e5424a286489a7cfa62418aaf7df5fc256b02abcead
22fc9db94dde4abede5891cd4620f45395a749029113e3221b23fb6c36c48a82
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
9fc43e8f6f26a254c4570b6ccd4e08a2a5f97bedcd1f3491ede9bbb8b5012d90
b875802fb81fcb53ed3281c5d8f737b151e5dc3b86a4876e917d424cd7dc82d1
e7901b3f246d6153315a3f0e45ac422b9b8d82346a83d67555428547b6a5e78a