URL: http://smtr.qgemail.com/t/gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=
Submission: On January 11 via manual from CA

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions.
The main IP is 204.145.1.1, located in Sussex, United States and belongs to QUAD-GRAPHICS - Quad/Graphics Inc., US. The main domain is smtr.qgemail.com.
This is the first time this domain was scanned on urlscan.io!

Verdict: Unknown

Downloads New! These files were downloaded by the website

Domain & IP information

IP Address AS Autonomous System
1 204.145.1.1 14882 (QUAD-GRAP...)
1 146.66.101.252 32475 (SINGLEHOP...)
2 2
Domain
Subdomains
Transfer
1 investigationcounsel.com
0 B
1 qgemail.com
2 KB
2 2
Domain Requested by
1 investigationcounsel.com smtr.qgemail.com
1 smtr.qgemail.com
2 2

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
investigationcounsel.com
Let's Encrypt Authority X3
2018-11-28 -
2019-02-26
3 months

Screenshot



Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=
/t
1 KB
2 KB
Document
General
Full URL
http://smtr.qgemail.com/t/gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=
Protocol
HTTP/1.1
Server
204.145.1.1 Sussex, United States, ASN14882 (QUAD-GRAPHICS - Quad/Graphics Inc., US),
Reverse DNS
Software
/
Resource Hash
3210f997446ddd5a80f6a779b891d89199c9ab2f356523c179657cf27341a076
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
smtr.qgemail.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 11 Jan 2019 19:00:56 GMT
Server
Cache-Control
no-cache, must-revalidate, max-age=0
Expires
-1
Pragma
no-cache
X-Content-Type-Options
nosniff
Content-Length
1494
Connection
close
Content-Type
text/html;charset=ascii
NOTICE-OF-CERTIFICATION-Norton-Antivirus-Class-Action-I0294526xB96A8.pdf
investigationcounsel.com/wp-content/uploads/2018/11
0
0
Document
General
Full URL
https://investigationcounsel.com/wp-content/uploads/2018/11/NOTICE-OF-CERTIFICATION-Norton-Antivirus-Class-Action-I0294526xB96A8.pdf
Requested by
Host: smtr.qgemail.com
URL: http://smtr.qgemail.com/t/gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
146.66.101.252 , Bulgaria, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS
ip-146-66-101-252.siteground.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

:method
GET
:authority
investigationcounsel.com
:scheme
https
:path
/wp-content/uploads/2018/11/NOTICE-OF-CERTIFICATION-Norton-Antivirus-Class-Action-I0294526xB96A8.pdf
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://smtr.qgemail.com/t/gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://smtr.qgemail.com/t/gcH1AAjbaDIOOoQB2AfGUDrLIO9aDGTpaaaaaaBODRPWiaa?k=JX6AjtJ1J1NMJSp1NXJ2g4qgTX~amp;m=RsR7.jqR0dj~25v9knc3j.lfv~amp;c=l~amp;o=

Response headers

status
200
server
nginx
date
Fri, 11 Jan 2019 19:00:57 GMT
content-type
application/pdf
content-length
77287
last-modified
Mon, 26 Nov 2018 19:21:07 GMT
etag
"12de7-57b963c1abecd"
host-header
192fc2e7e50945beb8231a492d6a8024
strict-transport-security
max-age=300
x-proxy-cache
HIT
accept-ranges
bytes

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Base64 function| decodeHTML function| getAnchorandRedirect

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators of compromise (IoCs)

This is a term in the security industry to describe indicators around an attack. This includes IPs, hashes, domains, etc.

investigationcounsel.com
smtr.qgemail.com


146.66.101.252
204.145.1.1

3210f997446ddd5a80f6a779b891d89199c9ab2f356523c179657cf27341a076