www.dctalk.org Open in urlscan Pro
23.254.224.197 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.dctalk.org/adobe-pdf/adb/
Submission: On November 21 via automatic, source phishtank (November 21st 2019, 8:42:24 am UTC)

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 23.254.224.197, located in Seattle, United States and belongs to HOSTWINDS - Hostwinds LLC., US. The main domain is www.dctalk.org.

This is the only time www.dctalk.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
8	23.254.224.197 23.254.224.197	54290 (HOSTWINDS) (HOSTWINDS - Hostwinds LLC.)
1 2	108.128.130.224 108.128.130.224	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9	3

8 23.254.224.197 (Seattle, United States)

ASN54290 (HOSTWINDS - Hostwinds LLC., US)
PTR: hwsrv-639771.hostwindsdns.com

www.dctalk.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.128.130.224 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

stats.adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	dctalk.org www.dctalk.org	284 KB
2	adobe.com 1 redirects stats.adobe.com	2 KB
9	2

	Domain	Requested by
8	www.dctalk.org	www.dctalk.org
2	stats.adobe.com	1 redirects www.dctalk.org
9	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.dctalk.org/adobe-pdf/adb/
Frame ID: 41B7DDEFF24AFE97271C458D1E5382ED
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

285 kB
Transfer

294 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E92BEC0-1F6CDEC12456FBF9&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=http%3A%2F%2Fwww.dctalk.org%2Fadobe-pdf%2Fadb%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&pccr=true&vidn=2EEB26F08515A6A5-600009C64B09C09E&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E92BEC0-1F6CDEC12456FBF9&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=http%3A%2F%2Fwww.dctalk.org%2Fadobe-pdf%2Fadb%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.dctalk.org/adobe-pdf/adb/ 262 KB
262 KB 405ms
56ms Document
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash: 07db32e9c36e0ca21a29fde1827f845a3eb1dfc25723bc823d846ba117196fc9

Request headers

Host: www.dctalk.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:08 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found ath5djs.htm
www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ 0
0 28ms
15ms Script
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ath5djs.htm
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:08 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found d_002.htm
www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ 0
0 25ms
13ms Stylesheet
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/d_002.htm
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:08 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found d.htm
www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ 0
0 27ms
14ms Stylesheet
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/d.htm
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:08 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK pdf.png
www.dctalk.org/adobe-pdf/adb/ 21 KB
22 KB 26ms
13ms Image
image/png 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.dctalk.org/adobe-pdf/adb/pdf.png
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash: 6e0f417f988453ef8a165e97e7c88aefd4f25290ad56f3cceaca4795584b81d6

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:08 GMT
Last-Modified: Sat, 24 Mar 2018 10:09:36 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 21954

GET
H/1.1 404
Not Found d_002.htm
www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ 0
0 14ms
13ms Stylesheet
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/d_002.htm
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:09 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found d.htm
www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/ 0
0 14ms
13ms Stylesheet
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dctalk.org/adobe-pdf/adb/Sign%20in%20-%20Adobe%20Files_files/d.htm
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:09 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

s07976907573802
stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/
Redirect Chain

http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E92BEC0-1F6CDEC12456FBF9&ce=UTF-8&ns=adobecorp&pag...
http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&pccr=true&vidn=2EEB26F08515A6A5-600009C64B09C09E&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E...

43 B
749 B

28ms
28ms

Image
image/gif

108.128.130.224
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&pccr=true&vidn=2EEB26F08515A6A5-600009C64B09C09E&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E92BEC0-1F6CDEC12456FBF9&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=http%3A%2F%2Fwww.dctalk.org%2Fadobe-pdf%2Fadb%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/

Protocol

HTTP/1.1

Server

108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-108-128-130-224.eu-west-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date: Thu, 21 Nov 2019 08:42:08 GMT
x-content-type-options: nosniff
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 22 Nov 2019 08:42:09 GMT
server: jag
xserver: anedge-65bcc487c6-v886v
etag: 3380838759738474496-4616517644756483396
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Nov 2019 08:42:09 GMT

Redirect headers

pragma: no-cache
date: Thu, 21 Nov 2019 08:42:08 GMT
x-content-type-options: nosniff
last-modified: Fri, 22 Nov 2019 08:42:09 GMT
server: jag
xserver: anedge-65bcc487c6-b5lzf
location: http://stats.adobe.com/b/ss/adbimsqa,adbadobenonacdcqa/1/JS-1.2.3/s07976907573802?AQB=1&pccr=true&vidn=2EEB26F08515A6A5-600009C64B09C09E&ndh=1&t=21%2F10%2F2019%209%3A42%3A9%204%20-60&fid=5B272A592E92BEC0-1F6CDEC12456FBF9&ce=UTF-8&ns=adobecorp&pageName=Account%3AOnLoad_ims_SignInForm&g=http%3A%2F%2Fwww.dctalk.org%2Fadobe-pdf%2Fadb%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AOnLoad_ims_SignInForm&v13=SignInForm&v30=adobedotcom_TOU_client2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-type: text/plain
content-length: 0
x-xss-protection: 1; mode=block
expires: Wed, 20 Nov 2019 08:42:09 GMT

GET
H/1.1 404
Not Found squarespinner_2x.gif
www.dctalk.org/renga-idprovider/resources/web_v2/img/ 315 B
315 B 14ms
13ms Image
text/html 23.254.224.197
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.dctalk.org/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
Requested by: Host: www.dctalk.org
URL: http://www.dctalk.org/adobe-pdf/adb/
Protocol: HTTP/1.1
Server: 23.254.224.197 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: hwsrv-639771.hostwindsdns.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: http://www.dctalk.org/adobe-pdf/adb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 08:42:09 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dctalk.org/	1969-12-31 23:59:59	Name: s_cc Value: true
			.dctalk.org/	1970-01-21 01:09:38	Name: s_fid Value: 5B272A592E92BEC0-1F6CDEC12456FBF9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

stats.adobe.com
www.dctalk.org
108.128.130.224
23.254.224.197
07db32e9c36e0ca21a29fde1827f845a3eb1dfc25723bc823d846ba117196fc9
0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc
6e0f417f988453ef8a165e97e7c88aefd4f25290ad56f3cceaca4795584b81d6
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

www.dctalk.org Open in urlscan Pro 23.254.224.197 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

285 kBTransfer

294 kBSize

2 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

35 JavaScript Global Variables

2 Cookies

Indicators

www.dctalk.org Open in urlscan Pro
23.254.224.197 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

285 kB
Transfer

294 kB
Size

2
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!