pdf.aqauproperties.com

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is pdf.aqauproperties.com.
TLS certificate: Issued by WE1 on July 11th 2024. Valid for: 3 months.

This is the only time pdf.aqauproperties.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Adobe Update

Domain & IP information

	IP Address	AS Autonomous System
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
1	199.232.192.193 199.232.192.193	54113 (FASTLY) (FASTLY)
2 2	2a02:26f0:480... 2a02:26f0:480:33::212:40d1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:480... 2a02:26f0:480:f::213:7ed5	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	5

1 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

pdf.aqauproperties.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.192.193 (United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:33::212:40d1 (Frankfurt am Main, Germany) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)

adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:f::213:7ed5 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	adobe.com 2 redirects adobe.com — Cisco Umbrella Rank: 228 www.adobe.com — Cisco Umbrella Rank: 2661	1 KB
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 7108	48 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	30 KB
1	aqauproperties.com pdf.aqauproperties.com	10 KB
5	4

	Domain	Requested by
2	www.adobe.com
2	adobe.com	2 redirects
1	i.imgur.com	pdf.aqauproperties.com
1	code.jquery.com	pdf.aqauproperties.com
1	pdf.aqauproperties.com
5	5

This site contains no links.

Subject Issuer	Validity	Valid
aqauproperties.com WE1	`2024-07-11` - `2024-10-09`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pdf.aqauproperties.com/5884.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Frame ID: 75344E1F5DC875006C5B1B68AF07CC6B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In - PDF CLOUD

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

60 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

89 kB
Transfer

180 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://adobe.com/favicon.ico HTTP 301
https://www.adobe.com/favicon.ico

Request Chain 5

https://adobe.com/favicon.ico HTTP 301
https://www.adobe.com/favicon.ico

5 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request 5884.0.jsp Show response
pdf.aqauproperties.com/ 23 KB
10 KB 154ms
113ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pdf.aqauproperties.com/5884.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b6b0785b77bcb02d0bd1d5db5af32dd94906f20219947840badc8c44941d0a1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a807379ab595d4e-FRA
content-encoding: br
content-type: text/html;charset=ISO-8859-1
date: Wed, 24 Jul 2024 02:23:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qnBtPmgjhirbdudOHcKuOPWbwXr1n1M8%2FatOUM69ho2UDHpW39kSYfxMx0gaJbj75FbZNOM74YCxRHWidlL2xUf9ps5%2BPFL%2BVVIkHWXuv1gkLuqXUSdsNohsGWNtVVpQ%2FP9xipUKlezy"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 1001 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 634e6e82dbd1604a2cfd9b0303f024ef20c71eca2d655a3a2c2fd5680a5a3ed9

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f57218e76eb6adab56df94b4a32ea7873703bd3701dde45af952605cfc5a5693

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 172ms
47ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: pdf.aqauproperties.com
URL: https://pdf.aqauproperties.com/5884.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://pdf.aqauproperties.com/
Origin: https://pdf.aqauproperties.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 02:23:56 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 5517480
x-cache: HIT, HIT
content-length: 30070
x-served-by: cache-lga21947-LGA, cache-mad2200128-MAD
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1721787837.748670,VS0,VE0
etag: W/"28feccc0-152b5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 34334, 1798

GET
H2 200 qLcPmYb.jpg
i.imgur.com/ 48 KB
48 KB 163ms
46ms Image
image/jpeg 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/qLcPmYb.jpg

Requested by

Host: pdf.aqauproperties.com
URL: https://pdf.aqauproperties.com/5884.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

180f3bc8288f8f33b56133542536937dadecc33ceb27fcba770739061a4f5f80

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://pdf.aqauproperties.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 02:23:56 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
age: 883391
x-amz-cf-pop: IAD12-P2
x-cache: Miss from cloudfront, HIT, HIT
content-length: 48843
x-served-by: cache-iad-kjyo7100040-IAD, cache-mad22052-MAD
last-modified: Sat, 29 Dec 2018 09:03:04 GMT
server: cat factory 1.0
x-timer: S1721787837.778080,VS0,VE1
etag: "47eb410e11eb45bef6391d125b3dec31"
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: rFgHgIi4kZ4sdINeQiExoHpyJj8h_D4NFJxOMyXj9qvclnc3Ivfl0g==
x-cache-hits: 216, 0

GET
H2

200

favicon.ico
www.adobe.com/
Redirect Chain

https://adobe.com/favicon.ico
https://www.adobe.com/favicon.ico

9 KB
1 KB

175ms
32ms

Other
image/x-icon

2a02:26f0:480:f::213:7ed5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.adobe.com/favicon.ico

Protocol

H2

Server

2a02:26f0:480:f::213:7ed5 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

bf24c9e4d37f94d4bd2f870228ff421ca54b2949db3391dbd3818ec0e6db0f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://pdf.aqauproperties.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 02:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
akamai-cache-status: Hit from child
strict-transport-security: max-age=86400
akamai-grn-www.adobe.com: 0.957d1302.1721787837.208d47da
x-adobe-source: 128.84
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1721787837329_34831765_546129882_27_9550_20_88_219";dur=1
alt-svc: h3=":443"; ma=93600
content-length: 800
x-adobe-info: 9645848c-cb14-4920-9219-c23100ed2fd8, 9645848c-cb14-4920-9219-c23100ed2fd8
x-adobe-cache: HIT
last-modified: Tue, 23 Jul 2024 18:30:25 GMT
server: Apache
x-adobe-loc: ew1
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/x-icon
cache-control: max-age=21600
x-adobe-content: AEM-Offers
accept-ranges: bytes
expires: Wed, 24 Jul 2024 08:23:57 GMT

Redirect headers

location: https://www.adobe.com/favicon.ico
date: Wed, 24 Jul 2024 02:23:57 GMT
strict-transport-security: max-age=86400
server: AkamaiGHost
content-length: 0

GET
H2

200

favicon.ico
www.adobe.com/
Redirect Chain

https://adobe.com/favicon.ico
https://www.adobe.com/favicon.ico

9 KB
0

0ms
0ms

Other
image/x-icon

2a02:26f0:480:f::213:7ed5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.adobe.com/favicon.ico

Protocol

H2

Server

2a02:26f0:480:f::213:7ed5 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

bf24c9e4d37f94d4bd2f870228ff421ca54b2949db3391dbd3818ec0e6db0f5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://pdf.aqauproperties.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 02:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
akamai-cache-status: Hit from child
akamai-grn-www.adobe.com: 0.957d1302.1721787837.208d47da
x-adobe-source: 128.84
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1721787837329_34831765_546129882_27_9550_20_88_219";dur=1
alt-svc: h3=":443"; ma=93600
content-length: 800
x-adobe-info: 9645848c-cb14-4920-9219-c23100ed2fd8, 9645848c-cb14-4920-9219-c23100ed2fd8
x-adobe-cache: HIT
last-modified: Tue, 23 Jul 2024 18:30:25 GMT
server: Apache
x-adobe-loc: ew1
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/x-icon
cache-control: max-age=21600
x-adobe-content: AEM-Offers
accept-ranges: bytes
expires: Wed, 24 Jul 2024 08:23:57 GMT

Redirect headers

location: https://www.adobe.com/favicon.ico
date: Wed, 24 Jul 2024 02:23:57 GMT
server: AkamaiGHost
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Adobe Update

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pdf.aqauproperties.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 7A7617761108844CABC05C1A2575A53F

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adobe.com
code.jquery.com
i.imgur.com
pdf.aqauproperties.com
www.adobe.com
188.114.96.3
199.232.192.193
2a02:26f0:480:33::212:40d1
2a02:26f0:480:f::213:7ed5
2a04:4e42:200::649
180f3bc8288f8f33b56133542536937dadecc33ceb27fcba770739061a4f5f80
634e6e82dbd1604a2cfd9b0303f024ef20c71eca2d655a3a2c2fd5680a5a3ed9
7b6b0785b77bcb02d0bd1d5db5af32dd94906f20219947840badc8c44941d0a1
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
bf24c9e4d37f94d4bd2f870228ff421ca54b2949db3391dbd3818ec0e6db0f5f
f57218e76eb6adab56df94b4a32ea7873703bd3701dde45af952605cfc5a5693

pdf.aqauproperties.com Open in urlscan Pro 188.114.96.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

89 kBTransfer

180 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

pdf.aqauproperties.com Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

89 kB
Transfer

180 kB
Size

1
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!