urlscan.io logo urlscan.io
SecurityTrails logo

gw4200.fortimail.com Open in urlscan Pro
173.243.134.200  Public Scan

Go To Rescan Add Verdict Report
URL: https://gw4200.fortimail.com/fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm8...
Submission: On October 25 via manual from CO — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 173.243.134.200, located in Burnaby, Canada and belongs to FORTINET, US. The main domain is gw4200.fortimail.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on December 29th 2022. Valid for: a year.
This is the only time gw4200.fortimail.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

OFICIO DE ACTUACION PROCESAL RAD 2018-00358-01.tar 1 MB application/x-rar
MIME: RAR archive data, v4, os: Win32
Size: 1 MB (1337482 bytes, 100% done)
Downloaded from: https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e=download&uuid=1de4267d-04f7-4c63-b13e-6da2454da4e8

Domain & IP information

IP Address AS Autonomous System
2 173.243.134.200 40934 (FORTINET)
1 1 142.251.16.102 15169 (GOOGLE)
1 172.253.62.132 15169 (GOOGLE)
3 2
Apex Domain
Subdomains		 Transfer
2 fortimail.com
gw4200.fortimail.com
3 KB
1 googleusercontent.com
doc-0k-48-docs.googleusercontent.com
1 google.com
docs.google.com — Cisco Umbrella Rank: 342
1 KB
3 3
Domain Requested by
2 gw4200.fortimail.com gw4200.fortimail.com
1 doc-0k-48-docs.googleusercontent.com gw4200.fortimail.com
1 docs.google.com 1 redirects
3 3

This site contains no links.

Subject Issuer Validity Valid
*.fortimail.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-29 -
2024-01-29		 a year crt.sh
*.googleusercontent.com
GTS CA 1C3		 2023-09-28 -
2023-12-21		 3 months crt.sh

This page contains 1 frames:

Frame: https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e=download&uuid=1de4267d-04f7-4c63-b13e-6da2454da4e8
Frame ID: 795503B5359940796E7ACCC26DC44697
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

FortiMail Click Protection: Evaluating URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

3 kB
Transfer

5 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://docs.google.com/uc?export=download&id=1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ HTTP 303
  • https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e=download&uuid=1de4267d-04f7-4c63-b13e-6da2454da4e8

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
gw4200.fortimail.com/fmlurlsvc/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gw4200.fortimail.com/fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm84MjtvMzw5Mztpaj47PzhoPC1/Njo9MjM5Pz4zPDotemJvNjgyW059TEJfOzs8Oz45JjgyW059TEJdOzs8Oz45LXloe382amVsbmdqZlRoeX5xS2hkZGZufWolaGRmJWhkLWg2Mz8tY29nNjs=&url=https%3a%2f%2fdocs.google.com%2fuc%3fexport%3ddownload%26id%3d1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
173.243.134.200 Burnaby, Canada, ASN40934 (FORTINET, US),
Reverse DNS
gw4200.fortimail.com
Software
/
Resource Hash
903e0d58c6662f471aaed8cd7a3d10b59b1598ab0bd1c62571d7569b18e68cc4
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1708
Content-Security-Policy
script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'
Content-Type
text/html; CharSet=utf-8
Date
Wed, 25 Oct 2023 16:13:47 GMT
Keep-Alive
timeout=5, max=100
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
/
gw4200.fortimail.com//fmlurlsvc/ 		93 B
542 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw4200.fortimail.com//fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm84MjtvMzw5Mztpaj47PzhoPC1/Njo9MjM5Pz4zPDotemJvNjgyW059TEJfOzs8Oz45JjgyW059TEJdOzs8Oz45LXloe382amVsbmdqZlRoeX5xS2hkZGZufWolaGRmJWhkLWg2Mz8tY29nNjs=&url=https%3a%2f%2fdocs.google.com%2fuc%3fexport%3ddownload%26id%3d1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ&fmlEvlTk
Requested by
Host: gw4200.fortimail.com
URL: https://gw4200.fortimail.com/fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm84MjtvMzw5Mztpaj47PzhoPC1/Njo9MjM5Pz4zPDotemJvNjgyW059TEJfOzs8Oz45JjgyW059TEJdOzs8Oz45LXloe382amVsbmdqZlRoeX5xS2hkZGZufWolaGRmJWhkLWg2Mz8tY29nNjs=&url=https%3a%2f%2fdocs.google.com%2fuc%3fexport%3ddownload%26id%3d1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
173.243.134.200 Burnaby, Canada, ASN40934 (FORTINET, US),
Reverse DNS
gw4200.fortimail.com
Software
/
Resource Hash
af1e936b8066bf8078c550b7f5fa3c534cc1e35af6f91b0a7c2961fb9919e567
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gw4200.fortimail.com/fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm84MjtvMzw5Mztpaj47PzhoPC1/Njo9MjM5Pz4zPDotemJvNjgyW059TEJfOzs8Oz45JjgyW059TEJdOzs8Oz45LXloe382amVsbmdqZlRoeX5xS2hkZGZufWolaGRmJWhkLWg2Mz8tY29nNjs=&url=https%3a%2f%2fdocs.google.com%2fuc%3fexport%3ddownload%26id%3d1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
X-Requested-With
XMLHttpRequest
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Wed, 25 Oct 2023 16:13:47 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Content-Security-Policy
script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Access-Control-Allow-Origin
"*"
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
X-XSS-Protection
1; mode=block
1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/
Redirect Chain
  • https://docs.google.com/uc?export=download&id=1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
  • https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e=download&uuid=1de4267d-04f7-4c63-b13e-6da2454da4e8
Requested by
Host: gw4200.fortimail.com
URL: https://gw4200.fortimail.com/fmlurlsvc/?fewReq=:B:JVMxOj48MS19NjklOy1ibzY7OjE7Oi14Ymxlan9+eW42ODw9amo6bWlqbz06aDg8Mm8zaDluMm84MjtvMzw5Mztpaj47PzhoPC1/Njo9MjM5Pz4zPDotemJvNjgyW059TEJfOzs8Oz45JjgyW059TEJdOzs8Oz45LXloe382amVsbmdqZlRoeX5xS2hkZGZufWolaGRmJWhkLWg2Mz8tY29nNjs=&url=https%3a%2f%2fdocs.google.com%2fuc%3fexport%3ddownload%26id%3d1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
UploadServer /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gw4200.fortimail.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, X-Google-EOM, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-353267353-bin, x-goog-ext-353267353-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Android-Cert, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context
access-control-allow-methods
GET,HEAD,OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-disposition
attachment; filename="OFICIO DE ACTUACION PROCESAL RAD 2018-00358-01.tar"; filename*=UTF-8''OFICIO%20DE%20ACTUACION%20PROCESAL%20RAD%202018-00358-01.tar
content-length
1337482
content-type
application/x-tar
date
Wed, 25 Oct 2023 16:13:49 GMT
expires
Wed, 25 Oct 2023 16:13:49 GMT
last-modified
Wed, 25 Oct 2023 14:45:06 GMT
server
UploadServer
x-content-type-options
nosniff
x-goog-hash
crc32c=NeJ03w==
x-guploader-uploadid
ABPtcPp189mTfjovSHq08Ps_XtgDu9BAtstiuQBWrD1j72l7ITQy1x-hmSm1jWr4a5GwD3kBvLha4BjlIK4WQZMOTl_D_9aiGX_X

Redirect headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
content-security-policy
require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport script-src 'report-sample' 'nonce-M4L28PxzmMPBhK5l8TKIjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist
content-type
application/binary
cross-origin-opener-policy
same-origin
date
Wed, 25 Oct 2023 16:13:48 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
location
https://doc-0k-48-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/hdkn902h9tfsfdiah0l2353p4nnguto3/1698250425000/01723013136151114608/*/1_8l8SqrBx1rY8hSxnq2_5-3si15lL0TQ?e=download&uuid=1de4267d-04f7-4c63-b13e-6da2454da4e8
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
server
ESF
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| clickProtection

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

doc-0k-48-docs.googleusercontent.com
docs.google.com
gw4200.fortimail.com
142.251.16.102
172.253.62.132
173.243.134.200
903e0d58c6662f471aaed8cd7a3d10b59b1598ab0bd1c62571d7569b18e68cc4
af1e936b8066bf8078c550b7f5fa3c534cc1e35af6f91b0a7c2961fb9919e567