hamsted.getforge.io Open in urlscan Pro
107.20.213.245 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://hamsted.getforge.io/
Submission: On June 19 via manual (June 19th 2018, 3:05:43 pm UTC) from US

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 15 HTTP transactions. The main IP is 107.20.213.245, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is hamsted.getforge.io.

This is the only time hamsted.getforge.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address		AS Autonomous System
1	107.20.213.245 107.20.213.245		14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
12	66.216.167.145 66.216.167.145		7029 (WINDSTREAM) (WINDSTREAM - Windstream Communications LLC)
1	52.222.149.111 52.222.149.111		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.222.146.152 52.222.146.152		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
15	4

1 107.20.213.245 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-107-20-213-245.compute-1.amazonaws.com

hamsted.getforge.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 66.216.167.145 (Harrisburg, United States)

ASN7029 (WINDSTREAM - Windstream Communications LLC, US)
PTR: mail.pacounties.org

mail.pacounties.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.149.111 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-149-111.fra53.r.cloudfront.net

dooe3vx785zy.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.146.152 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-146-152.fra53.r.cloudfront.net

cdn.getforge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	pacounties.org mail.pacounties.org	25 KB
1	getforge.com cdn.getforge.com	3 KB
1	cloudfront.net dooe3vx785zy.cloudfront.net	4 KB
1	getforge.io hamsted.getforge.io	4 KB
15	4

	Domain	Requested by
12	mail.pacounties.org	hamsted.getforge.io
1	cdn.getforge.com	dooe3vx785zy.cloudfront.net
1	dooe3vx785zy.cloudfront.net	hamsted.getforge.io
1	hamsted.getforge.io
15	4

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://hamsted.getforge.io/
Frame ID: 55C6C912B8E42F5DC87D1EF4F2A72149
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Outlook Web App (Web Mail) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i
env /^IsOwaPremiumBrowser$/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i
env /^IsOwaPremiumBrowser$/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i
env /^IsOwaPremiumBrowser$/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i
env /^IsOwaPremiumBrowser$/i

Page Statistics

15
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

36 kB
Transfer

65 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://go.microsoft.com/fwlink/?LinkID=129362
Title: click here.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
hamsted.getforge.io/ 9 KB
4 KB 395ms
114ms Document
text/html 107.20.213.245
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 107.20.213.245 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-107-20-213-245.compute-1.amazonaws.com
Software: nginx/1.10.3 /
Resource Hash: 38fe4b3b33c8965911621d7c48d3e453bcad30d7af9b178cc4b3b3a41c561358

Request headers

Host: hamsted.getforge.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 55C6C912B8E42F5DC87D1EF4F2A72149

Response headers

Server: nginx/1.10.3
Date: Tue, 19 Jun 2018 15:05:30 GMT
Content-Type: text/html
Last-Modified: Tue, 19 Jun 2018 05:17:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5b2891f0-25e1"
Content-Encoding: gzip

GET
H/1.1 200
OK logon.css
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 2 KB
1 KB 582ms
106ms Stylesheet
text/css 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/logon.css
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1037

GET
H/1.1 200
OK owafont.css
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 5 KB
2 KB 580ms
106ms Stylesheet
text/css 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/owafont.css
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1773

GET
H/1.1 200
OK flogon.js Show response
mail.pacounties.org/owa/14.3.351.0/scripts/premium/ 4 KB
2 KB 579ms
106ms Script
application/x-javascript 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.pacounties.org/owa/14.3.351.0/scripts/premium/flogon.js
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Apr 2016 22:41:40 GMT
X-Powered-By: ASP.NET
ETag: "06aa17ac95d11:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1936

GET
H/1.1 200
OK lgntopl.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 4 KB
5 KB 104ms
103ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgntopl.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 4455

GET
H/1.1 200
OK lgntopr.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 581 B
838 B 103ms
102ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgntopr.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 581

GET
H/1.1 200
OK lgnexlogo.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 61 B
317 B 102ms
101ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnexlogo.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 61

GET
H/1.1 200
OK lgnbotl.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 9 KB
9 KB 308ms
107ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnbotl.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 9311

GET
H/1.1 200
OK lgnbotr.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 2 KB
3 KB 325ms
112ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnbotr.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 2392

GET
H/1.1 200
OK turbo.js Show response
dooe3vx785zy.cloudfront.net/assets/turbojs/8/ 13 KB
4 KB 359ms
10ms Script
application/javascript 52.222.149.111
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://dooe3vx785zy.cloudfront.net/assets/turbojs/8/turbo.js?version=8

Requested by

Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/

Protocol

HTTP/1.1

Server

52.222.149.111 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-52-222-149-111.fra53.r.cloudfront.net

Software

Cowboy /

Resource Hash

44577a20af79c780d43042e5cadfb6f4b8c27f3b6d65682a66515ac5dc2a4dfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 04 Apr 2018 16:12:34 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Thu, 22 Mar 2018 08:21:58 GMT
Server: Cowboy
Age: 6562376
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 vegur, 1.1 b2eb119180a1f499dade55aa4e26c619.cloudfront.net (CloudFront)
Cache-Control: public, max-age=31536000
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
X-Amz-Cf-Id: TYzPXSEHEtJK5oIYACQIMKphTtMJSlEPVBykkL9KU8zhAtwHwXvgdw==

GET
H/1.1 200
OK lgnbotm.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 276 B
533 B 321ms
112ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnbotm.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Request headers

Referer: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 276

GET
H/1.1 200
OK lgnright.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 306 B
563 B 188ms
105ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnright.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Request headers

Referer: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 306

GET
H/1.1 200
OK lgnleft.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 290 B
547 B 180ms
102ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgnleft.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Request headers

Referer: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 290

GET
H/1.1 200
OK lgntopm.gif
mail.pacounties.org/owa/14.3.351.0/themes/resources/ 58 B
314 B 188ms
105ms Image
image/gif 66.216.167.145
Windstream Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/lgntopm.gif
Requested by: Host: hamsted.getforge.io
URL: http://hamsted.getforge.io/
Protocol: HTTP/1.1
Server: 66.216.167.145 Harrisburg, United States, ASN7029 (WINDSTREAM - Windstream Communications LLC, US),
Reverse DNS: mail.pacounties.org
Software: / ASP.NET
Resource Hash: 9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Request headers

Referer: https://mail.pacounties.org/owa/14.3.351.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 15:05:31 GMT
Last-Modified: Wed, 06 Feb 2013 03:00:46 GMT
X-Powered-By: ASP.NET
ETag: "043c328164ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 58

GET
S 200 _squish.js Show response
cdn.getforge.com/hamsted.getforge.io/1529361374/ 14 KB
3 KB 578ms
420ms Script
text/javascript 52.222.146.152
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.getforge.com/hamsted.getforge.io/1529361374/_squish.js
Requested by: Host: dooe3vx785zy.cloudfront.net
URL: http://dooe3vx785zy.cloudfront.net/assets/turbojs/8/turbo.js?version=8
Protocol: SPDY
Server: 52.222.146.152 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-222-146-152.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e56617acd9b093181673da7c8f99ece83438a2f177883be2d07341f6261392d

Request headers

Referer: http://hamsted.getforge.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 19 Jun 2018 15:05:33 GMT
content-encoding: gzip
last-modified: Mon, 18 Jun 2018 22:36:16 GMT
server: AmazonS3
etag: "2ddd238d7e8dda348dadc0bcbc05c891"
x-cache: Miss from cloudfront
x-amz-version-id: BqL7uf3IBhsM0pd8K_3EbCChPKF1HsYC
status: 200
cache-control: max-age=2592000, public
accept-ranges: bytes
content-type: application/javascript, application/x-javascript, text/javascript
content-length: 3065
via: 1.1 b7f7970e9c911e165d4cb9f70deac42a.cloudfront.net (CloudFront)
x-amz-cf-id: sI6dYihiDWk2HyLod5-ATAcw08cxRsTgljuNZdgSFWKSFrGzeM8T7Q==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| secureCookie function| isHttps number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| TurboJS

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hamsted.getforge.io/	1969-12-31 23:59:59	Name: cookieTest Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://dooe3vx785zy.cloudfront.net/assets/turbojs/8/turbo.js?version=8(Line 373) Message: TurboJS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.getforge.com
dooe3vx785zy.cloudfront.net
hamsted.getforge.io
mail.pacounties.org
107.20.213.245
52.222.146.152
52.222.149.111
66.216.167.145
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060
38fe4b3b33c8965911621d7c48d3e453bcad30d7af9b178cc4b3b3a41c561358
44577a20af79c780d43042e5cadfb6f4b8c27f3b6d65682a66515ac5dc2a4dfe
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
9e56617acd9b093181673da7c8f99ece83438a2f177883be2d07341f6261392d
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301