form.jotform.com Open in urlscan Pro
35.201.118.58 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://form.jotform.com/200666905683058
Submission: On March 09 via manual (March 9th 2020, 4:19:41 pm UTC) from IN

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 35.201.118.58, located in Ascension Island and belongs to GOOGLE, US. The main domain is form.jotform.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 22nd 2019. Valid for: 2 years.

This is the only time form.jotform.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
10	35.201.118.58 35.201.118.58	15169 (GOOGLE) (GOOGLE)
1	104.17.64.4 104.17.64.4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	104.23.128.7 104.23.128.7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	35.190.41.132 35.190.41.132	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::729	54113 (FASTLY) (FASTLY)
14	4

10 35.201.118.58 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 58.118.201.35.bc.googleusercontent.com

form.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
events.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.64.4 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.23.128.7 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.41.132 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 132.41.190.35.bc.googleusercontent.com

files.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::729 (Ascension Island)

ASN54113 (FASTLY, US)

browser.sentry-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	jotfor.ms cdn.jotfor.ms	172 KB
6	jotform.com 2 redirects form.jotform.com www.jotform.com files.jotform.com events.jotform.com	280 KB
1	sentry-cdn.com browser.sentry-cdn.com	17 KB
1	cloudflare.com cdnjs.cloudflare.com	2 KB
14	4

	Domain	Requested by
8	cdn.jotfor.ms	form.jotform.com
2	files.jotform.com	form.jotform.com
2	www.jotform.com	2 redirects
1	events.jotform.com	form.jotform.com
1	browser.sentry-cdn.com	cdn.jotfor.ms
1	cdnjs.cloudflare.com	form.jotform.com
1	form.jotform.com
14	7

This site contains links to these domains. Also see Links.

Domain
www.jotform.com

Subject Issuer	Validity	Valid
jotform.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-22` - `2021-08-21`	2 years	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-05` - `2020-06-12`	6 months	crt.sh
*.jotform.com Sectigo RSA Domain Validation Secure Server CA	`2019-07-17` - `2021-07-16`	2 years	crt.sh
v2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-03-02` - `2021-02-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://form.jotform.com/200666905683058
Frame ID: B18139386CAFB35CD30B40F53D948316
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js/i

Google Cloud (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /^1\.1 google$/i

Page Statistics

14
Requests

100 %
HTTPS

20 %
IPv6

4
Domains

7
Subdomains

4
IPs

2
Countries

470 kB
Transfer

1006 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.jotform.com/?utm_source=formfooter&utm_medium=banner&utm_term=200666905683058&utm_content=jotform_logo&utm_campaign=powered_by_jotform_le

Search URL Search Domain Scan URL

URL: https://www.jotform.com/?utm_source=formfooter&utm_medium=banner&utm_term=200666905683058&utm_content=jotform_button&utm_campaign=powered_by_jotform_le
Title: Create your own JotForm

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

https://www.jotform.com/uploads/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg HTTP 302
https://files.jotform.com/jufs/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg

Request Chain 12

https://www.jotform.com/uploads/boss0987/form_files/out.5e642be26a9f49.81614210.png HTTP 302
https://files.jotform.com/jufs/boss0987/form_files/out.5e642be26a9f49.81614210.png

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 200666905683058 Show response
form.jotform.com/ 10 KB
3 KB 135ms
114ms Document
text/html 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: CacheX /
Resource Hash: a092d7a20b67daf5534840efdd255e776c498d2f1e25589263926094b6a95ffb

Request headers

:method: GET
:authority: form.jotform.com
:scheme: https
:path: /200666905683058
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
cache-hit: 1
content-encoding: gzip
content-type: text/html; charset=utf-8
engine: CacheX
expires: Thu, 01 Jan 1970 00:00:01 GMT
server: CacheX
vary: Accept-Encoding
date: Mon, 09 Mar 2020 16:19:14 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 formCss.css
cdn.jotfor.ms/static/ 65 KB
15 KB 126ms
124ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/static/formCss.css?3.3.15980
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6cedd18832c76739052b50e45e950cfc75a7c01878582590d0f77f68bd21efe8

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 16:19:14 GMT
content-encoding: gzip
last-modified: Mon, 09 Mar 2020 15:58:01 GMT
server: nginx
etag: W/"5e666789-102ce"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 nova.css
cdn.jotfor.ms/css/styles/ 33 KB
8 KB 118ms
117ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/styles/nova.css?3.3.15980
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3a94f035baf658530d3a928c7edc516a680cc048778b2525f97472f56d7a9af3

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 16:19:14 GMT
content-encoding: gzip
last-modified: Mon, 09 Mar 2020 06:50:54 GMT
server: nginx
etag: W/"5e65e74e-84a3"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 566a91c2977cdfcd478b4567.css
cdn.jotfor.ms/themes/CSS/ 13 KB
3 KB 4535ms
4534ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/themes/CSS/566a91c2977cdfcd478b4567.css?
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c9f745004be8950bb107fa54593349fd2bdbd857669b7544b9c5bb224377075e

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 16:19:18 GMT
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 07:10:01 GMT
server: nginx
etag: W/"69a9d6c0f9a77f19db6d25e5183912c4"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
status: 200
cache-control: no-cache
x-form-cache: MISS-APP
alt-svc: clear
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 form-submit-button-simple_blue.css
cdn.jotfor.ms/css/styles/buttons/ 2 KB
726 B 119ms
118ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/styles/buttons/form-submit-button-simple_blue.css?3.3.15980
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2c0fceda21ecff42aae9e61ac1845f5a1107f539847151e3d6b33a79721b2c02

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 16:19:14 GMT
content-encoding: gzip
last-modified: Thu, 02 May 2019 05:39:45 GMT
server: nginx
etag: W/"5cca82a1-885"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 punycode.min.js Show response
cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/ 3 KB
2 KB 10355ms
21ms Script
application/javascript 104.17.64.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/punycode.min.js

Requested by

Host: form.jotform.com
URL: https://form.jotform.com/200666905683058

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.64.4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2395ce599bba81b7b031207d511f3ccb41a68898bd02c41c0b352903f3013670

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 16:19:24 GMT
content-encoding: br
cf-cache-status: HIT
age: 14378580
cf-ray: 57161e0db912bd96-AMS
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:26:23 GMT
server: cloudflare
etag: W/"5afd4abf-aec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sat, 27 Feb 2021 16:19:24 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 prototype.forms.js Show response
cdn.jotfor.ms/static/ 126 KB
33 KB 4520ms
4519ms Script
application/x-javascript 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/static/prototype.forms.js
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7030794ecf5cfe1526d4e3757629f8d32b6bb6d81fcdcd97a9785f57f65887a6

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 16:19:18 GMT
content-encoding: gzip
last-modified: Mon, 09 Mar 2020 15:58:02 GMT
server: nginx
etag: W/"5e66678a-1f817"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jotform.forms.js Show response
cdn.jotfor.ms/static/ 419 KB
109 KB 128ms
127ms Script
application/x-javascript 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/static/jotform.forms.js?3.3.15980
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c7bf9d1eed41738743ccc23339bea83eff3ce0aa526f9e38ef57eecfe4fcb005

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 16:19:14 GMT
content-encoding: gzip
last-modified: Mon, 09 Mar 2020 15:58:02 GMT
server: nginx
etag: W/"5e66678a-68d5f"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo-new@1x.png
cdn.jotfor.ms/assets/img/logo/ 3 KB
4 KB 116ms
116ms Image
image/png 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.jotfor.ms/assets/img/logo/logo-new@1x.png
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2ba263b1abb6c0c0f3ca3474520eca640d01e03d1605909d84fe49a62107b3b1

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 16:19:14 GMT
via: 1.1 google
last-modified: Fri, 03 May 2019 11:58:09 GMT
server: nginx
access-control-allow-origin: *
etag: "5ccc2cd1-df9"
content-type: image/png
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
alt-svc: clear
content-length: 3577
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 printForm.css
cdn.jotfor.ms/css/ 456 B
563 B 4619ms
4619ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/printForm.css?3.3.15980
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b23b22d37aabecfaf4922f97f2b1fa93da87fd0a284624f7f8fa00bf40b37cb7

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 16:19:18 GMT
via: 1.1 google
last-modified: Thu, 16 May 2019 07:50:58 GMT
server: nginx
etag: "5cdd1662-1c8"
content-type: text/css
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
alt-svc: clear
content-length: 456
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

hotmail%20page%20img.5e642c195ab206.16551312.jpg
files.jotform.com/jufs/boss0987/form_files/
Redirect Chain

https://www.jotform.com/uploads/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg
https://files.jotform.com/jufs/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg

273 KB
274 KB

136ms
118ms

Image
application/octet-stream

35.190.41.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://files.jotform.com/jufs/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.41.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.41.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 09 Mar 2020 16:19:25 GMT
via: 1.1 google
content-disposition: attachment; filename="hotmail page img.5e642c195ab206.16551312.jpg"
access-control-allow-origin: *
alt-svc: clear
content-type: application/octet-stream

Redirect headers

date: Mon, 09 Mar 2020 16:19:24 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://files.jotform.com/jufs/boss0987/form_files/hotmail%20page%20img.5e642c195ab206.16551312.jpg
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache
x-form-cache: MISS-APP
cf-ray: 57161e103895bfb1-MAN
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 bundle.min.js Show response
browser.sentry-cdn.com/5.13.0/ 55 KB
17 KB 22ms
6ms Script
application/javascript 2a04:4e42:200::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/5.13.0/bundle.min.js

Requested by

Host: cdn.jotfor.ms
URL: https://cdn.jotfor.ms/static/prototype.forms.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::729 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ca6e54cb47c15a7f795b2389a7272cd3d9c61a75eac4b8b55bad610ac43dcd2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://form.jotform.com/200666905683058
Origin: https://form.jotform.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 16:19:24 GMT
content-encoding: gzip
last-modified: Fri, 28 Feb 2020 12:30:12 GMT
server: Fastly
age: 877467
etag: "54771c037d5e0987df909c0b5a8add40"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17177
expires: Sat, 27 Feb 2021 12:34:56 GMT

GET
H2 204 /
events.jotform.com/form/200666905683058/ 0
216 B 132ms
114ms Image
text/plain 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.jotform.com/form/200666905683058/?ref=&res=1600x1200&eventID=1583770764484_200666905683058_TtaSa2a&loc=https%253A%252F%252Fform.jotform.com%252F200666905683058
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 16:19:24 GMT
via: 1.1 google
last-modified: Mon, 09 Mar 2020 12:19:24 GMT
access-control-allow-origin: *
content-type: text/plain; charset=utf-8
status: 204
alt-svc: clear
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: origin, content-type, accept
expires: Thu, 1 Jan 1970 00:00:00 GMT

GET
H2

200

out.5e642be26a9f49.81614210.png
files.jotform.com/jufs/boss0987/form_files/
Redirect Chain

https://www.jotform.com/uploads/boss0987/form_files/out.5e642be26a9f49.81614210.png
https://files.jotform.com/jufs/boss0987/form_files/out.5e642be26a9f49.81614210.png

2 KB
2 KB

135ms
117ms

Image
application/octet-stream

35.190.41.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://files.jotform.com/jufs/boss0987/form_files/out.5e642be26a9f49.81614210.png
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/200666905683058
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.41.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.41.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 3d7f15588d110f4268dfa1af2e1a1cb9281860dd451cedf0f2b0c85b21a6ef7b

Request headers

Referer: https://form.jotform.com/200666905683058
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 09 Mar 2020 16:19:25 GMT
via: 1.1 google
content-disposition: attachment; filename="out.5e642be26a9f49.81614210.png"
access-control-allow-origin: *
alt-svc: clear
content-type: application/octet-stream

Redirect headers

date: Mon, 09 Mar 2020 16:19:24 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://files.jotform.com/jufs/boss0987/form_files/out.5e642be26a9f49.81614210.png
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache
x-form-cache: MISS-APP
cf-ray: 57161e10389fbfb1-MAN
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.jotform.com/	1970-01-19 08:39:22	Name: __cfduid Value: dd76dfd349e0a8a8c83d5acdee419a07b1583770764

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.sentry-cdn.com
cdn.jotfor.ms
cdnjs.cloudflare.com
events.jotform.com
files.jotform.com
form.jotform.com
www.jotform.com
104.17.64.4
104.23.128.7
2a04:4e42:200::729
35.190.41.132
35.201.118.58
2395ce599bba81b7b031207d511f3ccb41a68898bd02c41c0b352903f3013670
2ba263b1abb6c0c0f3ca3474520eca640d01e03d1605909d84fe49a62107b3b1
2c0fceda21ecff42aae9e61ac1845f5a1107f539847151e3d6b33a79721b2c02
3a94f035baf658530d3a928c7edc516a680cc048778b2525f97472f56d7a9af3
3d7f15588d110f4268dfa1af2e1a1cb9281860dd451cedf0f2b0c85b21a6ef7b
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
6cedd18832c76739052b50e45e950cfc75a7c01878582590d0f77f68bd21efe8
7030794ecf5cfe1526d4e3757629f8d32b6bb6d81fcdcd97a9785f57f65887a6
a092d7a20b67daf5534840efdd255e776c498d2f1e25589263926094b6a95ffb
b23b22d37aabecfaf4922f97f2b1fa93da87fd0a284624f7f8fa00bf40b37cb7
c7bf9d1eed41738743ccc23339bea83eff3ce0aa526f9e38ef57eecfe4fcb005
c9f745004be8950bb107fa54593349fd2bdbd857669b7544b9c5bb224377075e
ca6e54cb47c15a7f795b2389a7272cd3d9c61a75eac4b8b55bad610ac43dcd2f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

form.jotform.com Open in urlscan Pro 35.201.118.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

20 %IPv6

4 Domains

7 Subdomains

4 IPs

2 Countries

470 kBTransfer

1006 kBSize

1 Cookies

2 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

48 JavaScript Global Variables

1 Cookies

Indicators

form.jotform.com Open in urlscan Pro
35.201.118.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

20 %
IPv6

4
Domains

7
Subdomains

4
IPs

2
Countries

470 kB
Transfer

1006 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!