employee-covidnotice.aegpresents.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 35.202.254.90, located in United States and belongs to GOOGLE, US. The main domain is employee-covidnotice.aegpresents.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 1st 2020. Valid for: 3 months.

This is the only time employee-covidnotice.aegpresents.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.202.254.90 35.202.254.90	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:df4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
3	3

1 35.202.254.90 (United States)

ASN15169 (GOOGLE, US)
PTR: 90.254.202.35.bc.googleusercontent.com

employee-covidnotice.aegpresents.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:df4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.aegworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

docs.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	google.com docs.google.com
1	aegworldwide.com www.aegworldwide.com	53 KB
1	aegpresents.com employee-covidnotice.aegpresents.com	2 KB
3	3

	Domain	Requested by
1	docs.google.com	employee-covidnotice.aegpresents.com
1	www.aegworldwide.com	employee-covidnotice.aegpresents.com
1	employee-covidnotice.aegpresents.com
3	3

This site contains no links.

Subject Issuer	Validity	Valid
aeg-ms44-prod.trafficmanager.net Let's Encrypt Authority X3	`2020-12-01` - `2021-03-01`	3 months	crt.sh
www.aegworldwide.com DigiCert SHA2 Secure Server CA	`2020-05-19` - `2022-07-13`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://employee-covidnotice.aegpresents.com/
Frame ID: 0374F6D5FBE080C3CA996736BD885E96
Requests: 2 HTTP requests in this frame

Frame: https://docs.google.com/forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw/viewform?embedded=true
Frame ID: 44FE83FC213A820894DA17D5760D2AF8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

67 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

56 kB
Transfer

55 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
employee-covidnotice.aegpresents.com/ 2 KB
2 KB 412ms
123ms Document
text/html 35.202.254.90
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://employee-covidnotice.aegpresents.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 35.202.254.90 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 90.254.202.35.bc.googleusercontent.com
Software: nginx/1.16.1 / PHP/7.3.22
Resource Hash: 497e62a14e2925e55890f64271cbcf198f7f61a248407b158b2ba5e0032d0283

Request headers

Host: employee-covidnotice.aegpresents.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.16.1
Date: Wed, 02 Dec 2020 19:17:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.22

GET
H2 200 AEG%20Presents%20Logo.jpg
www.aegworldwide.com/sites/default/files/styles/large/public/press-release/2019-03/ 53 KB
53 KB 1283ms
1141ms Image
image/jpeg 2606:4700::6812:df4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aegworldwide.com/sites/default/files/styles/large/public/press-release/2019-03/AEG%20Presents%20Logo.jpg?itok=DfKmBLg4

Requested by

Host: employee-covidnotice.aegpresents.com
URL: https://employee-covidnotice.aegpresents.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:df4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6d68e7225c8fbb638917ec7f72073a5dbf5c96edf6f711ef970b56e9717f2f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://employee-covidnotice.aegpresents.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:17:53 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: MISS
x-geo-country
x-cache: MISS
x-ah-environment: prod
content-length: 54088
cf-request-id: 06c67cceee00001f3555297000000001
x-request-id: v-12fead88-34d3-11eb-ba1e-531393e67f96
last-modified: Wed, 13 Mar 2019 22:25:36 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Geo-Country, Accept-Encoding
content-type: image/jpeg
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 5fb763f7ed0d1f35-FRA
expires: Wed, 16 Dec 2020 19:17:52 GMT

GET
H2 200 viewform
docs.google.com/forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw/ Frame 44FE 0
0 498ms
478ms Document
text/html 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://docs.google.com/forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw/viewform?embedded=true

Requested by

Host: employee-covidnotice.aegpresents.com
URL: https://employee-covidnotice.aegpresents.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-gv+TBrEK0WwucvhU47Wddw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: docs.google.com
:scheme: https
:path: /forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw/viewform?embedded=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://employee-covidnotice.aegpresents.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://employee-covidnotice.aegpresents.com/

Response headers

content-type: text/html; charset=utf-8
x-robots-tag: noindex, nofollow, nosnippet
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 02 Dec 2020 19:17:52 GMT
content-encoding: gzip
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-security-policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-gv+TBrEK0WwucvhU47Wddw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
set-cookie: NID=204=kmVDc1ipkMFGpmdkHikgeEq9ULvazy0HjbRlcfI_GU7chPekWZuXEmSHrVM8RYfJ0QAUfGTLLySRVbwwEjQRJlft4xcWmOqh849nU-cKKUZOaRG874ZFUcwtIr-KN9Wig5cCDuJzL_-5rAaely2SEyqTrplScfsctb5VrwKKuT0; expires=Thu, 03-Jun-2021 19:17:52 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none S=spreadsheet_forms=NQMPe6iSkDbSM0cI--HPLjBmCmifgXB_-O_Ljc1mr6s; Domain=.docs.google.com; Expires=Wed, 02-Dec-2020 20:17:52 GMT; Path=/forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw; Secure; HttpOnly; Priority=LOW; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.google.com/	1970-01-19 18:45:47	Name: NID Value: 204=kmVDc1ipkMFGpmdkHikgeEq9ULvazy0HjbRlcfI_GU7chPekWZuXEmSHrVM8RYfJ0QAUfGTLLySRVbwwEjQRJlft4xcWmOqh849nU-cKKUZOaRG874ZFUcwtIr-KN9Wig5cCDuJzL_-5rAaely2SEyqTrplScfsctb5VrwKKuT0
			.docs.google.com/forms/d/e/1FAIpQLScFZkQM2mWVfoBx7PvI7EtkxouhW5AUQ_vL6CI-NdepusQbzw	1970-01-19 14:22:20	Name: S Value: spreadsheet_forms=NQMPe6iSkDbSM0cI--HPLjBmCmifgXB_-O_Ljc1mr6s

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

docs.google.com
employee-covidnotice.aegpresents.com
www.aegworldwide.com
2606:4700::6812:df4
2a00:1450:4001:808::200e
35.202.254.90
497e62a14e2925e55890f64271cbcf198f7f61a248407b158b2ba5e0032d0283
a6d68e7225c8fbb638917ec7f72073a5dbf5c96edf6f711ef970b56e9717f2f2

employee-covidnotice.aegpresents.com Open in urlscan Pro 35.202.254.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

67 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

56 kBTransfer

55 kBSize

2 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

2 Cookies

Indicators

employee-covidnotice.aegpresents.com Open in urlscan Pro
35.202.254.90 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

56 kB
Transfer

55 kB
Size

2
Cookies

3 HTTP transactions
0 data transactions