20200727082631.lorezn.webredirect.org Open in urlscan Pro
104.144.123.142 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-...
Effective URL:
http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Submission: On July 27 via manual (July 27th 2020, 12:26:50 pm UTC) from GB

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 7 domains to perform 12 HTTP transactions. The main IP is 104.144.123.142, located in Los Angeles, United States and belongs to AS-COLOCROSSING, US. The main domain is 20200727082631.lorezn.webredirect.org.

This is the only time 20200727082631.lorezn.webredirect.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.123.16 167.89.123.16	11377 (SENDGRID) (SENDGRID)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	162.0.229.105 162.0.229.105	22612 (NAMECHEAP...) (NAMECHEAP-NET)
10	104.144.123.142 104.144.123.142	36352 (AS-COLOCR...) (AS-COLOCROSSING)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	2606:4700:303... 2606:4700:3037::6812:3afb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:817::2004	15169 (GOOGLE) (GOOGLE)
12	3

1 167.89.123.16 (United States) 1 redirects

ASN11377 (SENDGRID, US)

u17218878.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.0.229.105 (Canada) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

ijomg.gemashdirect.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.144.123.142 (Los Angeles, United States)

ASN36352 (AS-COLOCROSSING, US)

20200727082631.lorezn.webredirect.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::6812:3afb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

api.statvoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	webredirect.org 20200727082631.lorezn.webredirect.org	304 KB
1	google.com www.google.com	6 KB
1	statvoo.com 1 redirects api.statvoo.com	444 B
1	jquery.com code.jquery.com	24 KB
1	gemashdirect.xyz 1 redirects ijomg.gemashdirect.xyz	204 B
1	linkedin.com 1 redirects www.linkedin.com	2 KB
1	sendgrid.net 1 redirects u17218878.ct.sendgrid.net	335 B
12	7

	Domain	Requested by
10	20200727082631.lorezn.webredirect.org	20200727082631.lorezn.webredirect.org
1	www.google.com	20200727082631.lorezn.webredirect.org
1	api.statvoo.com	1 redirects
1	code.jquery.com	20200727082631.lorezn.webredirect.org
1	ijomg.gemashdirect.xyz	1 redirects
1	www.linkedin.com	1 redirects
1	u17218878.ct.sendgrid.net	1 redirects
12	7

This site contains no links.

Subject Issuer	Validity	Valid
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Frame ID: E7E97BC708BD70E25EF80AD178D6F0C4
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHj... HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash... HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200727082631.lorezn.webredirect.org/itint/ Page URL
http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

17 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

3
IPs

4
Countries

333 kB
Transfer

602 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlOBX6VACLU349CMcuml3b6M84SqB5rOS0vTQRjafwdVCQ2Bk2EYiIA_iRTqjR6UGrmJAMibGk9QK-2B-2Bf9-2BDFPfupV-2FUnH2HxLBG9ckRvbajiO-2BWOXwpQT-2BoZ1nBNFdVGEKaXgEXFHn6cavX3pUDhAFxrOmjM8gTvX-2B-2FfT6Jo-2FFR1C6BfRy4TUo4uxBERNqAKdG72WCu-2BemJNcfP4O9u8rmOSjRbyJ8dUBf2dzDvoPU-2FwSvfEgVziryOssWQXcdpzuuNtL15-2Fquejmp0avwcl9k6gtiRNkqlrHY4-3D HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R& HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200727082631.lorezn.webredirect.org/itint/ Page URL
http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlOBX6VACLU349CMcuml3b6M84SqB5rOS0vTQRjafwdVCQ2Bk2EYiIA_iRTqjR6UGrmJAMibGk9QK-2B-2Bf9-2BDFPfupV-2FUnH2HxLBG9ckRvbajiO-2BWOXwpQT-2BoZ1nBNFdVGEKaXgEXFHn6cavX3pUDhAFxrOmjM8gTvX-2B-2FfT6Jo-2FFR1C6BfRy4TUo4uxBERNqAKdG72WCu-2BemJNcfP4O9u8rmOSjRbyJ8dUBf2dzDvoPU-2FwSvfEgVziryOssWQXcdpzuuNtL15-2Fquejmp0avwcl9k6gtiRNkqlrHY4-3D HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R& HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200727082631.lorezn.webredirect.org/itint/

Request Chain 10

https://api.statvoo.com/favicon/?url=sesame.co.uk HTTP 302
https://www.google.com/s2/favicons?sz=64&domain_url=sesame.co.uk

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
20200727082631.lorezn.webredirect.org/itint/
Redirect Chain

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlO...
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R&
http://ijomg.gemashdirect.xyz/@9009@5600@/
http://20200727082631.lorezn.webredirect.org/itint/

3 KB
1 KB

888ms
367ms

Document
text/html

104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx / PHP/7.4.8RC1
Resource Hash: 62108409aaa6e82c185f70c66485636bacb61fda8064d2b78894f6fb845bfbaa

Request headers

Host: 20200727082631.lorezn.webredirect.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Mon, 27 Jul 2020 12:26:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.8RC1
Content-Encoding: gzip

Redirect headers

Date: Mon, 27 Jul 2020 12:26:31 GMT
Server: Apache
Location: http://20200727082631.lorezn.webredirect.org/itint/
Content-Length: 235
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 jquery-3.3.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 41ms
12ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://20200727082631.lorezn.webredirect.org/itint/
Origin: http://20200727082631.lorezn.webredirect.org

Response headers

date: Mon, 27 Jul 2020 12:26:32 GMT
content-encoding: gzip
last-modified: Sat, 20 Jan 2018 17:26:44 GMT
server: nginx
status: 200
etag: W/"5a637bd4-1111d"
vary: Accept-Encoding
x-hw: 1595852792.dop148.fr8.t,1595852792.cds263.fr8.hn,1595852792.cds274.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24038

GET
H/1.1 200
OK Primary Request / Show response
20200727082631.lorezn.webredirect.org/itint/review/ 5 KB
2 KB 199ms
198ms Document
text/html 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx / PHP/7.4.8RC1
Resource Hash: 07be6b9f130dd02f9490b6eb8bfb7651508ea7dba4e4014ed53b230827166ea5

Request headers

Host: 20200727082631.lorezn.webredirect.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://20200727082631.lorezn.webredirect.org/itint/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://20200727082631.lorezn.webredirect.org/itint/

Response headers

Server: nginx
Date: Mon, 27 Jul 2020 12:26:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.8RC1
Content-Encoding: gzip

GET
H/1.1 200
OK bootstrap.css
20200727082631.lorezn.webredirect.org/itint/review/filex/ 138 KB
21 KB 175ms
174ms Stylesheet
text/css 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/bootstrap.css
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Jul 2020 17:06:52 GMT
Server: nginx
ETag: W/"5f1b152c-22682"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.js Show response
20200727082631.lorezn.webredirect.org/itint/review/filex/ 85 KB
30 KB 342ms
331ms Script
application/javascript 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/jquery.js
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Jul 2020 17:06:52 GMT
Server: nginx
ETag: W/"5f1b152c-1538f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK bootstrap.js Show response
20200727082631.lorezn.webredirect.org/itint/review/filex/ 69 KB
21 KB 352ms
340ms Script
application/javascript 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/bootstrap.js
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Jul 2020 17:06:51 GMT
Server: nginx
ETag: W/"5f1b152b-1141a"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK general.css
20200727082631.lorezn.webredirect.org/itint/review/filex/ 2 KB
1 KB 338ms
327ms Stylesheet
text/css 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/general.css
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: dc3bd6047578cebc5589c2458a4a774c5dd0d7636b2fa8653ee0350acf6fa8b2

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Jul 2020 17:06:52 GMT
Server: nginx
ETag: W/"5f1b152c-965"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK email.png
20200727082631.lorezn.webredirect.org/itint/review/filex/ 60 KB
60 KB 170ms
168ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/email.png
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 50cb217c2efb7bd583639ea7427363e3e092e904786395ff781c17bf2ff7b395

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Last-Modified: Fri, 24 Jul 2020 17:06:52 GMT
Server: nginx
ETag: "5f1b152c-eed4"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 61140
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK user.png
20200727082631.lorezn.webredirect.org/itint/review/filex/ 16 KB
16 KB 177ms
176ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/user.png
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 57d172f0f57f3d5171f68cdd1f3324cfc7e714bb8d341be80b340dccc6947d3c

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Last-Modified: Fri, 24 Jul 2020 17:06:53 GMT
Server: nginx
ETag: "5f1b152d-40a8"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 16552
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK key.png
20200727082631.lorezn.webredirect.org/itint/review/filex/ 17 KB
18 KB 169ms
168ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/key.png
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 7822251ffeca6a927910e4b3b8621b2edbc694c0e82bc22376a32e9c5311dca5

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Last-Modified: Fri, 24 Jul 2020 17:06:52 GMT
Server: nginx
ETag: "5f1b152c-4556"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 17750
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK secured2.png
20200727082631.lorezn.webredirect.org/itint/review/filex/ 133 KB
134 KB 168ms
167ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200727082631.lorezn.webredirect.org/itint/review/filex/secured2.png
Requested by: Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 95ea768c0e353d9d91eef6ed6fddc65ae09fabb0c41b11ff47e88cb411340083

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 27 Jul 2020 12:26:39 GMT
Last-Modified: Fri, 24 Jul 2020 17:06:53 GMT
Server: nginx
ETag: "5f1b152d-215ee"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 136686
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

favicons
www.google.com/s2/
Redirect Chain

https://api.statvoo.com/favicon/?url=sesame.co.uk
https://www.google.com/s2/favicons?sz=64&domain_url=sesame.co.uk

5 KB
6 KB

110ms
109ms

Image
image/png

2a00:1450:4001:817::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/s2/favicons?sz=64&domain_url=sesame.co.uk

Requested by

Host: 20200727082631.lorezn.webredirect.org
URL: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2fc076a08ac99aacc2c6a57bddebe704701107ea7541852d995d22f3f0e3d698

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2XJu5ZudYLiwcKJysyoioA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-2XJu5ZudYLiwcKJysyoioA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://20200727082631.lorezn.webredirect.org/itint/review/?id=kyle.marsh@sesame.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 27 Jul 2020 12:26:40 GMT
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private, max-age=86400
content-security-policy: script-src 'report-sample' 'nonce-2XJu5ZudYLiwcKJysyoioA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-2XJu5ZudYLiwcKJysyoioA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 27 Jul 2020 12:26:40 GMT

Redirect headers

date: Mon, 27 Jul 2020 12:26:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.com/s2/favicons?sz=64&domain_url=sesame.co.uk
cf-ray: 5b96599feb4505f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0431d657ee000005f1da9e4200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20200727082631.lorezn.webredirect.org
api.statvoo.com
code.jquery.com
ijomg.gemashdirect.xyz
u17218878.ct.sendgrid.net
www.google.com
www.linkedin.com
104.144.123.142
162.0.229.105
167.89.123.16
2001:4de0:ac19::1:b:3a
2606:4700:3037::6812:3afb
2620:1ec:21::14
2a00:1450:4001:817::2004
07be6b9f130dd02f9490b6eb8bfb7651508ea7dba4e4014ed53b230827166ea5
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2fc076a08ac99aacc2c6a57bddebe704701107ea7541852d995d22f3f0e3d698
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec
50cb217c2efb7bd583639ea7427363e3e092e904786395ff781c17bf2ff7b395
57d172f0f57f3d5171f68cdd1f3324cfc7e714bb8d341be80b340dccc6947d3c
62108409aaa6e82c185f70c66485636bacb61fda8064d2b78894f6fb845bfbaa
7822251ffeca6a927910e4b3b8621b2edbc694c0e82bc22376a32e9c5311dca5
928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52
95ea768c0e353d9d91eef6ed6fddc65ae09fabb0c41b11ff47e88cb411340083
dc3bd6047578cebc5589c2458a4a774c5dd0d7636b2fa8653ee0350acf6fa8b2
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

20200727082631.lorezn.webredirect.org Open in urlscan Pro 104.144.123.142 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

17 %HTTPS

57 %IPv6

7 Domains

7 Subdomains

3 IPs

4 Countries

333 kBTransfer

602 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

20200727082631.lorezn.webredirect.org Open in urlscan Pro
104.144.123.142 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

17 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

3
IPs

4
Countries

333 kB
Transfer

602 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!