omegacham.s3.fr-par.scw.cloud Open in urlscan Pro
2001:bc8:10::7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://omegacham.s3.fr-par.scw.cloud/omega_cham.html#andrew.chung%40cybg.com
Effective URL:
https://omegacham.s3.fr-par.scw.cloud/omega_cham.html
Submission Tags: falconsandbox
Submission: On June 24 via api (June 24th 2022, 11:56:02 am UTC) from US — Scanned from FR

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2001:bc8:10::7, located in France and belongs to Online SAS, FR. The main domain is omegacham.s3.fr-par.scw.cloud.
TLS certificate: Issued by R3 on May 16th 2022. Valid for: 3 months.

This is the only time omegacham.s3.fr-par.scw.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2001:bc8:10::7 2001:bc8:10::7	12876 (Online SAS) (Online SAS)
1	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.229.133.221 192.229.133.221	15133 (EDGECAST) (EDGECAST)
1	2606:50c0:800... 2606:50c0:8001::154	54113 (FASTLY) (FASTLY)
4	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	6

1 2001:bc8:10::7 (France)

ASN12876 (Online SAS, FR)

omegacham.s3.fr-par.scw.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.133.221 (United States)

ASN15133 (EDGECAST, US)

www.w3schools.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8001::154 (United States)

ASN54113 (FASTLY, US)

raw.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1942 ka-f.fontawesome.com — Cisco Umbrella Rank: 4239	32 KB
1	githubusercontent.com raw.githubusercontent.com — Cisco Umbrella Rank: 4620	354 KB
1	w3schools.com www.w3schools.com — Cisco Umbrella Rank: 15388	5 KB
1	scw.cloud omegacham.s3.fr-par.scw.cloud	565 KB
8	4

	Domain	Requested by
4	ka-f.fontawesome.com	kit.fontawesome.com
1	raw.githubusercontent.com	omegacham.s3.fr-par.scw.cloud
1	www.w3schools.com	omegacham.s3.fr-par.scw.cloud
1	kit.fontawesome.com	omegacham.s3.fr-par.scw.cloud
1	omegacham.s3.fr-par.scw.cloud
8	5

This site contains no links.

Subject Issuer	Validity	Valid
s3.fr-par.scw.cloud R3	`2022-05-16` - `2022-08-14`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
*.w3schools.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-08` - `2023-05-04`	a year	crt.sh
*.github.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-07` - `2023-04-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-12` - `2022-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://omegacham.s3.fr-par.scw.cloud/omega_cham.html
Frame ID: F05A5C123235A1A397EB5B343A8B5449
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authenticating ...

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Page Statistics

8
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

956 kB
Transfer

1431 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request omega_cham.html Show response
omegacham.s3.fr-par.scw.cloud/ 564 KB
565 KB 327ms
241ms Document
text/html 2001:bc8:10::7
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://omegacham.s3.fr-par.scw.cloud/omega_cham.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:bc8:10::7 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: /
Resource Hash: 154efdc8841af8c835d22b028d77d222b6038c8618979ec6c309ab9f94b29b8f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

accept-ranges: bytes
content-length: 577642
content-type: text/html
date: Fri, 24 Jun 2022 11:55:57 GMT
etag: "cac285e14ea5e21c66e40630ba055da4"
last-modified: Sun, 19 Jun 2022 22:13:19 GMT
x-amz-id-2: tx2512c55c57cb431ebe77e-0062b5a64d
x-amz-request-id: tx2512c55c57cb431ebe77e-0062b5a64d
x-amz-version-id: 1655676799792533

GET
H2 200 c2d4bde48d.js Show response
kit.fontawesome.com/ 11 KB
4 KB 127ms
65ms Script
text/javascript 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/c2d4bde48d.js

Requested by

Host: omegacham.s3.fr-par.scw.cloud
URL: https://omegacham.s3.fr-par.scw.cloud/omega_cham.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f419ac55273c9026713c4d9d1e04cb45e1fa7a7db74b28f3ac29c72eb739353e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer: https://omegacham.s3.fr-par.scw.cloud/
Origin: https://omegacham.s3.fr-par.scw.cloud
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 11:55:57 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 72054706af0e331c-CDG
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: Fvonq6KFz-ikH35d5fCB

GET
H2 200 w3.css
www.w3schools.com/w3css/4/ 23 KB
5 KB 99ms
19ms Stylesheet
text/css 192.229.133.221
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.w3schools.com/w3css/4/w3.css

Requested by

Host: omegacham.s3.fr-par.scw.cloud
URL: https://omegacham.s3.fr-par.scw.cloud/omega_cham.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.133.221 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (pab/6F93) / ASP.NET

Resource Hash

c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com;
X-Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com;

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;
content-encoding: gzip
etag: "0aee4a9787d81:0"
last-modified: Fri, 24 Jun 2022 06:53:00 GMT
server: ECS (pab/6F93)
age: 14038
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
cache-control: public,max-age=14400,public
date: Fri, 24 Jun 2022 11:55:57 GMT
accept-ranges: bytes
content-length: 5258
x-content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com;

GET
H2 200 bgmen.jpg
raw.githubusercontent.com/202219910200/cloudrepo/main/ 354 KB
354 KB 160ms
114ms Image
image/jpeg 2606:50c0:8001::154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://raw.githubusercontent.com/202219910200/cloudrepo/main/bgmen.jpg

Requested by

Host: omegacham.s3.fr-par.scw.cloud
URL: https://omegacham.s3.fr-par.scw.cloud/omega_cham.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8a7424d3b8498c186b2fa5b0286661f2d79001303ed7de3dd31a497800ccfdb3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-fastly-request-id: f9c7ddfc06ebda7590d3d80223953a2c7132e09d
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding,Origin
content-length: 362157
x-xss-protection: 1; mode=block
x-served-by: cache-cdg20755-CDG
x-github-request-id: DFAA:3162:1AF7E9:1E67CC:62B59B48
x-timer: S1656071758.950874,VS0,VE94
x-frame-options: deny
date: Fri, 24 Jun 2022 11:55:58 GMT
source-age: 0
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
etag: W/"0482106232e0720a3c30e0c16a4408ff729cef35f4dcf7cf9a8ebab143db5184"
accept-ranges: bytes
expires: Fri, 24 Jun 2022 12:00:58 GMT

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.1.1/css/ 99 KB
21 KB 105ms
35ms Fetch
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.1.1/css/free.min.css?token=c2d4bde48d
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c2d4bde48d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0281802cc2ff5e8b90c99ba9ad7368b961d1260e4337b5a98b4c2127ff2e7c11

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 11:55:58 GMT
via: 1.1 987196530f90845d1356080568bb67c6.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392327
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 22 Mar 2022 15:20:25 GMT
server: cloudflare
etag: W/"e928f2f6625d980162008b5be6edbbd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FkvZJ0qZhNABEMeUpJHjiterfoO7C%2BX%2BYbPdzxSh%2BmpwlVNnbKrn7bb4kSsLkEsbETB5pMWAn4nBrtw71igsnSoYnvJdAx9jrfkzv2BxEjv0QvQGHyLLo7ytY8CDJm8zCnEScLMT%2FWAcPwfFD1zlrrsNSw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: CDG53-C1
cf-ray: 720547078be53b3d-CDG
access-control-allow-headers: fa-kit-token
x-amz-cf-id: _RkQvKimUQ42JnUNMw3letfIChGOP-6O_KSK1GEprmiWAHVqopSRmw==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.1.1/css/ 26 KB
5 KB 102ms
32ms Fetch
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.1.1/css/free-v4-shims.min.css?token=c2d4bde48d
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c2d4bde48d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdb6555be3041a9a8cfcc4eb73472e4c8d5ecdaef1fc9348046f2e55744ec271

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 11:55:58 GMT
via: 1.1 01e7df96c01c9ecdb1cce1b6595ae260.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 99831
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 22 Mar 2022 15:20:25 GMT
server: cloudflare
etag: W/"b11f2a3228edadb911f3cd3055998a78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2FFOdol93jtKGXrGMRF8FGQAf9aSWtTlnM3SCWL3xOTt5dohSN3cB%2F%2BSnA%2FUZD51JD13%2BS7ad020FLrA1C1oxiXFQS7d7Z8ZO5oghAoSWzwEL41%2FYyn2jNUjVCL26C5C5VsVA350UxTTiZ1hYjSF37QnKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: CDG53-C1
cf-ray: 720547078be83b3d-CDG
access-control-allow-headers: fa-kit-token
x-amz-cf-id: Ju24nDUKxTL-axJCij9azMyMRs5TcjgDLuYdl12HYWV2va23lk071A==

GET
H2 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.1.1/css/ 823 B
714 B 110ms
40ms Fetch
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.1.1/css/free-v5-font-face.min.css?token=c2d4bde48d
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c2d4bde48d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d00b137617ca412b948102cd10f2c393fc78cbce53bf505fdeb161dd0e8e8157

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 11:55:58 GMT
via: 1.1 39f309504c11c4fe223e3b1f0425f198.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392327
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 22 Mar 2022 15:20:24 GMT
server: cloudflare
etag: W/"03dccdffea10bc97343873a08295ab21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XCBpwkfKCIeVLG9K6m8nsUYnl0zoWQ7TaWH1ibDgksfg6inWmC0BADhHaP5fj29uGCGyeZ7gE8UqOV9exkT%2B5zRttf4XCSI3XbuYxk9N4eOtXu527nl2gpP7n5IR2VyEtic6MTHM4g8Oj%2FkFLDADByiHSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: CDG53-C1
cf-ray: 720547078bed3b3d-CDG
access-control-allow-headers: fa-kit-token
x-amz-cf-id: KuNe2-VMyJkohuho8tSY2D2BcQ7gSXMuyQumFCdQ8pYMmaVD4OT2oA==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.1.1/css/ 2 KB
1 KB 107ms
38ms Fetch
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.1.1/css/free-v4-font-face.min.css?token=c2d4bde48d
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c2d4bde48d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a077714458698c2b217b2656e483a4055c3af9eef97e0cc26536c171c32359b2

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://omegacham.s3.fr-par.scw.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 11:55:58 GMT
via: 1.1 a59d71d20a534fe6bccf3e7b2136c3ae.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 99831
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 22 Mar 2022 15:20:24 GMT
server: cloudflare
etag: W/"46869a1d043f8dda8670a973b0773719"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NiTaC2yRNKfaSf3WCyTSmC3cOa9%2BsK5Kf0h%2FT77GvETYs6X1D877umpL8sZ2PmLEPnBDm5g%2Fb%2F43NtkASjbWgjDle3zHH3JcoLmGGjKtAl9LeVfqyeQIM8TrDCAiKm4W2CMTyfcT6gk0JTdWvJ9t65yyJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: CDG53-C1
cf-ray: 720547078bee3b3d-CDG
access-control-allow-headers: fa-kit-token
x-amz-cf-id: rP3Y5VevZumJOOg8pG9YPX_Uznp95xHgzwdwcv4ZdYgod6ccFDdO4A==

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fa82d030aca102b39e357291206b8b133d9f920c781c7d270d2c73f6ee7b61b

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 32 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34b2fa39e4d967d0d32bc42dcc83d20aca8261f7a70bbbd844c5c3700b3162eb

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 88 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4b91d1b8888b77fdbf5d54b3ed71f03b1473cd97bb13fadb4fe5efe0e7eaf20

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 222 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f422dc1efc7ca439c68506c34c4604a3b05c7d51f038b2d2e6d6a1fa7ae28f7

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

61 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ka-f.fontawesome.com
kit.fontawesome.com
omegacham.s3.fr-par.scw.cloud
raw.githubusercontent.com
www.w3schools.com
192.229.133.221
2001:bc8:10::7
2606:4700::6812:1734
2606:50c0:8001::154
2a06:98c1:3121::3
0281802cc2ff5e8b90c99ba9ad7368b961d1260e4337b5a98b4c2127ff2e7c11
154efdc8841af8c835d22b028d77d222b6038c8618979ec6c309ab9f94b29b8f
1fa82d030aca102b39e357291206b8b133d9f920c781c7d270d2c73f6ee7b61b
34b2fa39e4d967d0d32bc42dcc83d20aca8261f7a70bbbd844c5c3700b3162eb
4f422dc1efc7ca439c68506c34c4604a3b05c7d51f038b2d2e6d6a1fa7ae28f7
8a7424d3b8498c186b2fa5b0286661f2d79001303ed7de3dd31a497800ccfdb3
a077714458698c2b217b2656e483a4055c3af9eef97e0cc26536c171c32359b2
b4b91d1b8888b77fdbf5d54b3ed71f03b1473cd97bb13fadb4fe5efe0e7eaf20
bdb6555be3041a9a8cfcc4eb73472e4c8d5ecdaef1fc9348046f2e55744ec271
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
d00b137617ca412b948102cd10f2c393fc78cbce53bf505fdeb161dd0e8e8157
f419ac55273c9026713c4d9d1e04cb45e1fa7a7db74b28f3ac29c72eb739353e

omegacham.s3.fr-par.scw.cloud Open in urlscan Pro 2001:bc8:10::7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

80 %IPv6

4 Domains

5 Subdomains

6 IPs

2 Countries

956 kBTransfer

1431 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

61 JavaScript Global Variables

0 Cookies

Indicators

omegacham.s3.fr-par.scw.cloud Open in urlscan Pro
2001:bc8:10::7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

956 kB
Transfer

1431 kB
Size

0
Cookies

8 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!