nhssbs-comms.net - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 104.16.208.86, located in and belongs to CLOUDFLARENET, US. The main domain is nhssbs-comms.net.
TLS certificate: Issued by GTS CA 1P5 on January 26th 2023. Valid for: 3 months.

This is the only time nhssbs-comms.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

100095_mc-letterhead-change-of-address.pdf 65 KB application/pdf

SHA256: 99d236c11eb265109200c8e807471b1fe3c487aa81f09ad4bd171d6a012a1159

MIME: PDF document, version 1.7

Size: 65 KB (66384 bytes, 100% done)

Downloaded from: https://i.emlfiles4.com/cmpdoc/8/4/3/1/0/2/files/100095_mc-letterhead-change-of-address.pdf?utm_campaign=2489483_ACTION%3A%20New%20Leeds%20Address%20-%20Supplier%20Communication%20020&utm_medium=email&Org_Name=&ORG_TYPE=&Firstname=&dm_i=4BD0,1HCWB,7X1AH3,6VDU0,1

Domain & IP information

	IP Address	AS Autonomous System
4	104.16.208.86 104.16.208.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:bb98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2

4 104.16.208.86 (None, )

ASN13335 (CLOUDFLARENET, US)

nhssbs-comms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:bb98 (United States)

ASN13335 (CLOUDFLARENET, US)

i.emlfiles4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	nhssbs-comms.net nhssbs-comms.net	27 KB
1	emlfiles4.com i.emlfiles4.com — Cisco Umbrella Rank: 25147
5	2

	Domain	Requested by
4	nhssbs-comms.net	nhssbs-comms.net
1	i.emlfiles4.com
5	2

This site contains links to these domains. Also see Links.

Domain
i.emlfiles4.com

Subject Issuer	Validity	Valid
nhssbs-comms.net GTS CA 1P5	`2023-01-26` - `2023-04-26`	3 months	crt.sh
i.emlfiles4.com GTS CA 1P5	`2023-01-26` - `2023-04-26`	3 months	crt.sh

This page contains 2 frames:

Frame: https://i.emlfiles4.com/cmpdoc/8/4/3/1/0/2/files/100095_mc-letterhead-change-of-address.pdf?utm_campaign=2489483_ACTION%3A%20New%20Leeds%20Address%20-%20Supplier%20Communication%20020&utm_medium=email&Org_Name=&ORG_TYPE=&Firstname=&dm_i=4BD0,1HCWB,7X1AH3,6VDU0,1
Frame ID: 1F00AF606C0CA85D14ACF3687B6953B2
Requests: 2 HTTP requests in this frame

Frame: https://nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1675843200
Frame ID: 7F16F60F86C14394F09A9E0F91338033
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

27 kB
Transfer

52 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://i.emlfiles4.com/cmpdoc/8/4/3/1/0/2/files/100095_mc-letterhead-change-of-address.pdf?utm_campaign=2489483_ACTION%3A%20New%20Leeds%20Address%20-%20Supplier%20Communication%20020&utm_medium=email&Org_Name=&ORG_TYPE=&Firstname=&dm_i=4BD0,1HCWB,7X1AH3,6VDU0,1
Title: Klicken Sie hier, um sich Ihr Dokument anzeigen zu lassen

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request c.aspx Show response nhssbs-comms.net/4BD0-1HCWB-7X1AH3-1B1EH4-1/	2 KB 2 KB	117ms 84ms	Document text/html	104.16.208.86 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nhssbs-comms.net/4BD0-1HCWB-7X1AH3-1B1EH4-1/c.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.208.86 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d6023ec42efbc91f0394addb88cdb34f49518e8a8a3da15ad58f373cfe036a61` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control private, max-age=0 cf-cache-status DYNAMIC cf-ray 79634b4b1fb22bd7-FRA content-encoding gzip content-type text/html date Wed, 08 Feb 2023 09:21:16 GMT server cloudflare
GET H2	200	invisible.js Show response nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 7F16	31 KB 16 KB	15ms 15ms	Script application/javascript	104.16.208.86 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1675843200 Requested by Host: nhssbs-comms.net URL: https://nhssbs-comms.net/4BD0-1HCWB-7X1AH3-1B1EH4-1/c.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.208.86 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3151f1c16953f10de0eef5bf8eec6b963d5e2ad11b98bb713dd7dfce8a47f0e6` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers date Wed, 08 Feb 2023 09:21:16 GMT content-encoding gzip server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 79634b4be8782bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	100095_mc-letterhead-change-of-address.pdf i.emlfiles4.com/cmpdoc/8/4/3/1/0/2/files/	0 0	165ms 132ms	Document application/pdf	2606:4700::6810:bb98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://i.emlfiles4.com/cmpdoc/8/4/3/1/0/2/files/100095_mc-letterhead-change-of-address.pdf?utm_campaign=2489483_ACTION%3A%20New%20Leeds%20Address%20-%20Supplier%20Communication%20020&utm_medium=email&Org_Name=&ORG_TYPE=&Firstname=&dm_i=4BD0,1HCWB,7X1AH3,6VDU0,1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:bb98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://nhssbs-comms.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status MISS cf-ray 79634b4c18393616-FRA content-length 66384 content-type application/pdf date Wed, 08 Feb 2023 09:21:16 GMT etag "95bb08f3438ba2b8b773246bc7abd49d" last-modified Tue, 07 Feb 2023 11:11:08 GMT server cloudflare vary Accept-Encoding x-amz-id-2 h22O+V/FS6NRRAynxEqf4Wf9kQE8wuoaMSsi5f8lGTWEVl3XbTMuv7GSvb12ihWqxUhzJ73w98Q= x-amz-request-id 9VTKP8QRWHMBHAVQ x-amz-version-id B6COUytaD9qwJWEIj91sJj3BXQk6cOUu
GET H3	200	pica.js nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/ Frame 7F16	19 KB 9 KB	13ms 13ms	Other application/javascript	104.16.208.86 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/pica.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.208.86 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9e440f754d6eeb54f4769217c267e3d16ce0dedd98f5c4e4591385ea79fe0cd8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers date Wed, 08 Feb 2023 09:21:16 GMT content-encoding gzip server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 79634b4c0c793804-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	79634b4b1fb22bd7 Show response nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 7F16	2 B 445 B	34ms 33ms	XHR text/plain	104.16.208.86 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/cv/result/79634b4b1fb22bd7 Requested by Host: nhssbs-comms.net URL: https://nhssbs-comms.net/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1675843200 Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.208.86 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Content-Type application/json Response headers date Wed, 08 Feb 2023 09:21:16 GMT content-encoding gzip server cloudflare cf-ray 79634b4e0ed03804-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| oncontentvisibilityautostatechange

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nhssbs-comms.net/	1970-01-20 09:32:10	Name: __cflb Value: 0H28vbka3Tp63XFuYsqHHrawjcNu2NdBWSnJFjdqhiU
			.nhssbs-comms.net/	1970-01-20 09:30:49	Name: __cf_bm Value: Z7to7AVxtysfxUQq0EUyFy3yaLvnleTr63dg6MoETUU-1675848076-0-AXwj+EWFnRFkkD6qy/cFBt9L6GgH1oP2IdWb7Gn87u6rLuYPcVqp2ETGFBGJmfr3JQ8i4sbXegFgqH8qgYAxKXZspOQsKsT+FRuiPkn6zYzhnamx6AdKqtI405mmA4oU09huVseawYKqgjVK1LTiAtKFjnLjlBCU91Vgvg7mTKk0V2gs6m9aGs7BOjiLMnLiEg==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.emlfiles4.com
nhssbs-comms.net
104.16.208.86
2606:4700::6810:bb98
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3151f1c16953f10de0eef5bf8eec6b963d5e2ad11b98bb713dd7dfce8a47f0e6
9e440f754d6eeb54f4769217c267e3d16ce0dedd98f5c4e4591385ea79fe0cd8
d6023ec42efbc91f0394addb88cdb34f49518e8a8a3da15ad58f373cfe036a61

nhssbs-comms.net Open in urlscan Pro 104.16.208.86 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

27 kBTransfer

52 kBSize

2 Cookies

1 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

2 Cookies

Indicators

nhssbs-comms.net Open in urlscan Pro
104.16.208.86 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

27 kB
Transfer

52 kB
Size

2
Cookies

5 HTTP transactions
0 data transactions