acrobatreaderx.tk Open in urlscan Pro
2606:4700:3036::ac43:af99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u17058732.ct.sendgrid.net/ls/click?upn=G2vnzTUfX304UImuZwaePd8aJqegAVBCVCMhx4hFaiAVBskXcMVQp0eaUf7-2B8mvM0GpMPKFOKeyyZFPrl...
Effective URL:
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMz...
Submission: On June 19 via manual (June 19th 2020, 3:24:16 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3036::ac43:af99, located in United States and belongs to CLOUDFLARENET, US. The main domain is acrobatreaderx.tk.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 19th 2020. Valid for: a year.

This is the only time acrobatreaderx.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Adobe Update

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.118.35 167.89.118.35	11377 (SENDGRID) (SENDGRID)
4	169.62.254.82 169.62.254.82	36351 (SOFTLAYER) (SOFTLAYER)
3 9	2606:4700:303... 2606:4700:3036::ac43:af99	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2

1 167.89.118.35 (United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789118x35.outbound-mail.sendgrid.net

u17058732.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 169.62.254.82 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 52.fe.3ea9.ip4.static.sl-reverse.com

online-pdf.us-south.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:3036::ac43:af99 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

acrobatreaderx.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	acrobatreaderx.tk 3 redirects acrobatreaderx.tk	433 KB
4	appdomain.cloud online-pdf.us-south.cf.appdomain.cloud	3 KB
1	sendgrid.net 1 redirects u17058732.ct.sendgrid.net	292 B
10	3

	Domain	Requested by
9	acrobatreaderx.tk	3 redirects acrobatreaderx.tk
4	online-pdf.us-south.cf.appdomain.cloud
1	u17058732.ct.sendgrid.net	1 redirects
10	3

This site contains no links.

Subject Issuer	Validity	Valid
*.us-south.cf.appdomain.cloud DigiCert SHA2 Secure Server CA	`2019-09-24` - `2020-09-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-06-19` - `2021-06-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com
Frame ID: A091355123C76890441B468915095568
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u17058732.ct.sendgrid.net/ls/click?upn=G2vnzTUfX304UImuZwaePd8aJqegAVBCVCMhx4hFaiAVBskXcMVQp0eaUf7-2B8... HTTP 302
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/index.php?login=mtgsales@firstt... HTTP 302
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c5455... HTTP 301
http://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c5455... HTTP 301
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c5455... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

434 kB
Transfer

491 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u17058732.ct.sendgrid.net/ls/click?upn=G2vnzTUfX304UImuZwaePd8aJqegAVBCVCMhx4hFaiAVBskXcMVQp0eaUf7-2B8mvM0GpMPKFOKeyyZFPrlGzly143MUl6P5mapAaPhiT3hqVt8X5qDOwxd1SMjSmziQCec8dEgblFwQ62BbVd9wFAfg-3D-3Dvg8h_libbNAvZdhijjjBOohYiu8kGWbRNmrox577Lq1BZfJ-2FO9G6uIPHCFVC4hqywccDqeOp-2FXO3myqrXaGlOpgVuvjkSXzd2EHdtYiOXHFsgIpx3Q503QupnCAH-2BxtnDMrgE-2Fi6EXri0MpouGwzkcWg2-2F77bshvLwKbHRSJdVeOlEZirbDauNqqQRD3DdvN0YOsW60UMhkQ6si4MqB-2FB6Tt0lQ-3D-3D HTTP 302
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Page URL
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/index.php?login=mtgsales@firsttechfed.com HTTP 302
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com HTTP 301
http://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com HTTP 301
https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://u17058732.ct.sendgrid.net/ls/click?upn=G2vnzTUfX304UImuZwaePd8aJqegAVBCVCMhx4hFaiAVBskXcMVQp0eaUf7-2B8mvM0GpMPKFOKeyyZFPrlGzly143MUl6P5mapAaPhiT3hqVt8X5qDOwxd1SMjSmziQCec8dEgblFwQ62BbVd9wFAfg-3D-3Dvg8h_libbNAvZdhijjjBOohYiu8kGWbRNmrox577Lq1BZfJ-2FO9G6uIPHCFVC4hqywccDqeOp-2FXO3myqrXaGlOpgVuvjkSXzd2EHdtYiOXHFsgIpx3Q503QupnCAH-2BxtnDMrgE-2Fi6EXri0MpouGwzkcWg2-2F77bshvLwKbHRSJdVeOlEZirbDauNqqQRD3DdvN0YOsW60UMhkQ6si4MqB-2FB6Tt0lQ-3D-3D HTTP 302
https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.php Show response online-pdf.us-south.cf.appdomain.cloud/ Redirect Chain https://u17058732.ct.sendgrid.net/ls/click?upn=G2vnzTUfX304UImuZwaePd8aJqegAVBCVCMhx4hFaiAVBskXcMVQp0eaUf7-2B8mvM0GpMPKFOKeyyZFPrlGzly143MUl6P5mapAaPhiT3hqVt8X5qDOwxd1SMjSmziQCec8dEgblFwQ62BbVd9wFA... https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com	665 B 739 B	1420ms 960ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `a66e456b9269f89292f9f28e8055bb10548e1006b1b43bdd8134d6ad76215663` Request headers Host online-pdf.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 19 Jun 2020 15:23:59 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 9f474cea5eecd88f5a074b2d Redirect headers Server nginx Date Fri, 19 Jun 2020 15:23:59 GMT Content-Type text/html; charset=utf-8 Content-Length 111 Connection keep-alive Location https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com X-Robots-Tag noindex, nofollow
GET H/1.1	200 OK	index.php Show response online-pdf.us-south.cf.appdomain.cloud/	665 B 739 B	1627ms 1627ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `a66e456b9269f89292f9f28e8055bb10548e1006b1b43bdd8134d6ad76215663` Request headers Host online-pdf.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 19 Jun 2020 15:24:00 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 9f474cea5eecd8904b72dd61
GET H/1.1	200 OK	index.php Show response online-pdf.us-south.cf.appdomain.cloud/	665 B 739 B	445ms 445ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `a66e456b9269f89292f9f28e8055bb10548e1006b1b43bdd8134d6ad76215663` Request headers Host online-pdf.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 19 Jun 2020 15:24:02 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 9f474cea5eecd8925a076b4d
GET H/1.1	200 OK	index.php Show response online-pdf.us-south.cf.appdomain.cloud/	736 B 778 B	186ms 185ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `894e23006f51873f02fe9f3dba7b29819fbdfaa44a681daeb9ebc3a3edb4231d` Request headers Host online-pdf.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 19 Jun 2020 15:24:02 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 9f474cea5eecd8927cad4dff
GET H2	200	Primary Request / Show response acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/ Redirect Chain https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/index.php?login=mtgsales@firsttechfed.com https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyM... http://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyM... https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAy...	5 KB 1 KB	185ms 183ms	Document text/html	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.5 Resource Hash `e2aff78b0061265afd76532836669bd2b11f41a22c52d55e0c586203735ce077` Request headers :method GET :authority acrobatreaderx.tk :scheme https :path /clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=d3a5530cdc70859d5195eb5ea70dd8fa91592580242 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://online-pdf.us-south.cf.appdomain.cloud/index.php?login=mtgsales@firsttechfed.com Response headers status 200 date Fri, 19 Jun 2020 15:24:03 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.5 cf-cache-status DYNAMIC cf-request-id 036ec719670000d6e50c3da200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5a5e413bda8bd6e5-FRA content-encoding br Redirect headers Date Fri, 19 Jun 2020 15:24:03 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Fri, 19 Jun 2020 16:24:03 GMT Location https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com cf-request-id 036ec7195500000ebb7d91d200000001 Vary Accept-Encoding Server cloudflare CF-RAY 5a5e413bb8360ebb-FRA
GET H2	200	jquery.min.js Show response acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/	84 KB 29 KB	353ms 352ms	Script application/javascript	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/jquery.min.js Requested by Host: acrobatreaderx.tk URL: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365` Request headers Referer https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Jun 2020 15:24:04 GMT content-encoding br cf-cache-status MISS last-modified Fri, 19 Jun 2020 15:24:07 GMT server cloudflare etag W/"14e4e-5a8717bef2910" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5a5e413d1dafd6e5-FRA cf-request-id 036ec71a2f0000d6e50c3e7200000001
GET H2	200	e3.png acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/	119 KB 120 KB	437ms 436ms	Image image/png	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/e3.png Requested by Host: acrobatreaderx.tk URL: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f91938a6534d66ad9ca93f74025f77bca314a08157b455354d280be1193efc7e` Request headers Referer https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Jun 2020 15:24:04 GMT cf-cache-status MISS last-modified Fri, 19 Jun 2020 15:24:07 GMT server cloudflare etag "1dd69-5a8717bec5d4b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5a5e413d1db1d6e5-FRA content-length 122217 cf-request-id 036ec71a2f0000d6e50c3e8200000001
GET H2	200	e7.png acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/	121 KB 121 KB	398ms 397ms	Image image/png	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/e7.png Requested by Host: acrobatreaderx.tk URL: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f80286d8a3c0538162f62c6646c961f6556df8a19a5b5091c074d4056fc3faa3` Request headers Referer https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Jun 2020 15:24:04 GMT cf-cache-status MISS last-modified Fri, 19 Jun 2020 15:24:07 GMT server cloudflare etag "1e241-5a8717bec9425" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5a5e413f5b98d6e5-FRA content-length 123457 cf-request-id 036ec71b980000d6e50c3ff200000001
GET H2	200	e8.png acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/	159 KB 159 KB	414ms 413ms	Image image/png	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/e8.png Requested by Host: acrobatreaderx.tk URL: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8cd6099bbaa0e3e2c9721345f4c06bd60142cc72bd5a4d190d35dde57918ecb8` Request headers Referer https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Jun 2020 15:24:04 GMT cf-cache-status MISS last-modified Fri, 19 Jun 2020 15:24:07 GMT server cloudflare etag "27c28-5a8717bec9425" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5a5e413f6bd1d6e5-FRA content-length 162856 cf-request-id 036ec71ba30000d6e50c001200000001
GET H2	200	file.png acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/	1 KB 1 KB	279ms 279ms	Image image/png	2606:4700:3036::ac43:af99 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/images/file.png Requested by Host: acrobatreaderx.tk URL: https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:af99 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ed2f86db7ac8ec202cc583c17a465e8ed33d7325e50a1d8b201bdbbfe60eaa6f` Request headers Referer https://acrobatreaderx.tk/clouddocument/acrobatreader/onlinefile/en-us/ad=775e967f814116889dfd1e9c545561b7/?session=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&ref=OWNlMzkxMDA2NjMwODIxMTc1NzdhMjAyMDk0MTY0ZWY=&login=mtgsales@firsttechfed.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Jun 2020 15:24:04 GMT cf-cache-status MISS last-modified Fri, 19 Jun 2020 15:24:07 GMT server cloudflare etag "58d-5a8717bec9425" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5a5e413f6bd4d6e5-FRA content-length 1421 cf-request-id 036ec71ba30000d6e50c002200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Adobe Update

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.acrobatreaderx.tk/	1970-01-19 11:06:12	Name: __cfduid Value: d3a5530cdc70859d5195eb5ea70dd8fa91592580242

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acrobatreaderx.tk
online-pdf.us-south.cf.appdomain.cloud
u17058732.ct.sendgrid.net
167.89.118.35
169.62.254.82
2606:4700:3036::ac43:af99
894e23006f51873f02fe9f3dba7b29819fbdfaa44a681daeb9ebc3a3edb4231d
8cd6099bbaa0e3e2c9721345f4c06bd60142cc72bd5a4d190d35dde57918ecb8
a66e456b9269f89292f9f28e8055bb10548e1006b1b43bdd8134d6ad76215663
b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365
e2aff78b0061265afd76532836669bd2b11f41a22c52d55e0c586203735ce077
ed2f86db7ac8ec202cc583c17a465e8ed33d7325e50a1d8b201bdbbfe60eaa6f
f80286d8a3c0538162f62c6646c961f6556df8a19a5b5091c074d4056fc3faa3
f91938a6534d66ad9ca93f74025f77bca314a08157b455354d280be1193efc7e

acrobatreaderx.tk Open in urlscan Pro 2606:4700:3036::ac43:af99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

434 kBTransfer

491 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

Indicators

acrobatreaderx.tk Open in urlscan Pro
2606:4700:3036::ac43:af99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

434 kB
Transfer

491 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!