quart-secondary.z13.web.core.windows.net Open in urlscan Pro
52.239.163.17  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response quart-secondary.z13.web.core.windows.net/	9 KB 10 KB	850ms 227ms	Document text/html	52.239.163.17 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://quart-secondary.z13.web.core.windows.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.163.17 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 74dbb6f5f0d3dadedf64e83422a71b64f6a9caf6bc8f4730a9fb46aa6e1201c6 Request headers Host quart-secondary.z13.web.core.windows.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Content-Length 9611 Content-Type text/html Last-Modified Tue, 17 Sep 2019 12:03:16 GMT Accept-Ranges bytes ETag "0x8D73B6706267D36" Server Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id e669c6f5-d01e-0108-635d-6d2337000000 x-ms-version 2018-03-28 Date Tue, 17 Sep 2019 13:43:01 GMT
GET H2	200	logo_norton_91x35.png now.symassets.com/content/dam/clp/global/images/non-product/logos/	4 KB 4 KB	256ms 16ms	Image image/png	104.103.97.33 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://now.symassets.com/content/dam/clp/global/images/non-product/logos/logo_norton_91x35.png Requested by Host: quart-secondary.z13.web.core.windows.net URL: https://quart-secondary.z13.web.core.windows.net/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.103.97.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-103-97-33.deploy.static.akamaitechnologies.com Software Apache/2.4.29 (Unix) Communique/4.2.2 / Resource Hash b71c79022578a104cbce78156a019993e7cba2df8a09865a8589e3d1f8205c0d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://quart-secondary.z13.web.core.windows.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Thu, 06 Sep 2018 03:55:32 GMT server Apache/2.4.29 (Unix) Communique/4.2.2 etag "e0b-5752bdcd05bf0" status 200 content-type image/png access-control-allow-origin * date Tue, 17 Sep 2019 13:43:01 GMT accept-ranges bytes content-length 3595 x-xss-protection 1; mode=block
GET H2	200	symantec-logo-top.png www.symantec.com/content/dam/symantec/images/common/	2 KB 3 KB	39ms 16ms	Image image/webp	2a02:26f0:eb:389::145b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.symantec.com/content/dam/symantec/images/common/symantec-logo-top.png Requested by Host: quart-secondary.z13.web.core.windows.net URL: https://quart-secondary.z13.web.core.windows.net/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:eb:389::145b , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Akamai Image Manager / Resource Hash 5c3882329f9c08203d823e491e69f63fb7aa8f53f6f80dcc04b34b2b1a2305be Request headers Sec-Fetch-Mode no-cors Referer https://quart-secondary.z13.web.core.windows.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 17 Sep 2019 13:43:01 GMT last-modified Sun, 15 Sep 2019 08:37:12 GMT server Akamai Image Manager status 200 etag "dfb-590cdaa73f396" access-control-max-age 1000 access-control-allow-methods GET, POST content-type image/webp access-control-allow-origin * cache-control private, no-transform, max-age=2400845 access-control-allow-headers X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding content-length 2194 x-im-result-width 163 expires Tue, 15 Oct 2019 08:37:06 GMT
GET H2	200	Screen%20Shot%202018-09-14%20at%203.48.42%20PM.png d3pbdh1dmixop.cloudfront.net/spark/Blog/reasons-why-spark-makes-the-best-inbox-by-gmail-alternative/	417 KB 417 KB	34ms 7ms	Image image/png	2600:9000:2057:fa00:1a:f17d:4240:21 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d3pbdh1dmixop.cloudfront.net/spark/Blog/reasons-why-spark-makes-the-best-inbox-by-gmail-alternative/Screen%20Shot%202018-09-14%20at%203.48.42%20PM.png Requested by Host: quart-secondary.z13.web.core.windows.net URL: https://quart-secondary.z13.web.core.windows.net/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:2057:fa00:1a:f17d:4240:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash 3af4940f346f8dabd2135647ae9f901ce2b654beb53fbd4dc81b0b0f08ad2cc3 Request headers Sec-Fetch-Mode no-cors Referer https://quart-secondary.z13.web.core.windows.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 16 Sep 2019 18:19:16 GMT via 1.1 e7e7960d7731a7583cedd8f1ff1aca38.cloudfront.net (CloudFront) last-modified Fri, 14 Sep 2018 12:49:14 GMT server AmazonS3 age 22449 etag "0523d1d07b0fd6582bcde6ff3fe95d68" x-cache Hit from cloudfront content-type image/png status 200 x-amz-cf-pop FRA6-C1 accept-ranges bytes content-length 426500 x-amz-cf-id 18NEZqWdH9Rn6ri0R16kCt51XLRkSGneCuyPbh11e4sLNWDj3fRpAg==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| checkform string| a string| b string| c string| d string| e string| code function| ValidCaptcha function| removeSpaces

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d3pbdh1dmixop.cloudfront.net
now.symassets.com
quart-secondary.z13.web.core.windows.net
www.symantec.com
104.103.97.33
2600:9000:2057:fa00:1a:f17d:4240:21
2a02:26f0:eb:389::145b
52.239.163.17
3af4940f346f8dabd2135647ae9f901ce2b654beb53fbd4dc81b0b0f08ad2cc3
5c3882329f9c08203d823e491e69f63fb7aa8f53f6f80dcc04b34b2b1a2305be
74dbb6f5f0d3dadedf64e83422a71b64f6a9caf6bc8f4730a9fb46aa6e1201c6
b71c79022578a104cbce78156a019993e7cba2df8a09865a8589e3d1f8205c0d