![](/screenshots/d84c89ac-d769-4781-b1b5-53601da3af2c.png)
eu2.contabostorage.com
Open in
urlscan Pro
173.249.62.85
Malicious Activity!
Public Scan
Effective URL: https://eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:doc/document3098.html
Submission: On August 12 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on July 9th 2024. Valid for: 3 months.
This is the only time eu2.contabostorage.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 34.122.158.70 34.122.158.70 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 173.249.62.85 173.249.62.85 | 51167 (CONTABO) (CONTABO) | |
1 | 104.18.19.62 104.18.19.62 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.179.87 192.229.179.87 | 15133 (EDGECAST) (EDGECAST) | |
1 | 192.0.78.148 192.0.78.148 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 2 | 108.139.10.28 108.139.10.28 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 142.251.221.74 142.251.221.74 | 15169 (GOOGLE) (GOOGLE) | |
6 | 172.67.139.119 172.67.139.119 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 18.67.93.31 18.67.93.31 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 9 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 70.158.122.34.bc.googleusercontent.com
track.sl.imkatconstruction.com |
ASN51167 (CONTABO, DE)
PTR: eu2.contabostorage.com
eu2.contabostorage.com |
ASN16509 (AMAZON-02, US)
PTR: server-108-139-10-28.sfo5.r.cloudfront.net
ip9uk39kv26rml8wjjruzg-on.drv.tw | |
ip9uk39kv26rml8wjjruzg.on.drv.tw |
ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f10.1e100.net
ajax.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-93-31.syd62.r.cloudfront.net
logo.clearbit.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3618 ka-f.fontawesome.com — Cisco Umbrella Rank: 7493 |
204 KB |
2 |
clearbit.com
logo.clearbit.com — Cisco Umbrella Rank: 46929 |
4 KB |
2 |
drv.tw
1 redirects
ip9uk39kv26rml8wjjruzg-on.drv.tw ip9uk39kv26rml8wjjruzg.on.drv.tw |
2 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
30 KB |
1 |
icones.pro
icones.pro |
7 KB |
1 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 37965 |
5 KB |
1 |
contabostorage.com
eu2.contabostorage.com — Cisco Umbrella Rank: 264586 |
326 KB |
1 |
imkatconstruction.com
1 redirects
track.sl.imkatconstruction.com |
288 B |
14 | 8 |
Domain | Requested by | |
---|---|---|
6 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | logo.clearbit.com |
eu2.contabostorage.com
|
1 | ajax.googleapis.com |
eu2.contabostorage.com
|
1 | ip9uk39kv26rml8wjjruzg.on.drv.tw |
eu2.contabostorage.com
|
1 | ip9uk39kv26rml8wjjruzg-on.drv.tw | 1 redirects |
1 | icones.pro |
eu2.contabostorage.com
|
1 | www.w3schools.com |
eu2.contabostorage.com
|
1 | kit.fontawesome.com |
eu2.contabostorage.com
|
1 | eu2.contabostorage.com | |
1 | track.sl.imkatconstruction.com | 1 redirects |
14 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.contabostorage.com ZeroSSL RSA Domain Secure Site CA |
2024-07-09 - 2024-10-07 |
3 months | crt.sh |
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-07-30 - 2025-01-27 |
6 months | crt.sh |
*.w3schools.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-04-03 - 2025-05-04 |
a year | crt.sh |
tls.automattic.com E5 |
2024-08-02 - 2024-10-31 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
ka-f.fontawesome.com WE1 |
2024-07-01 - 2024-09-29 |
3 months | crt.sh |
clearbit.com Amazon RSA 2048 M03 |
2024-01-22 - 2025-02-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:doc/document3098.html
Frame ID: C83D642F94F6230248E79B89DF460CC8
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/d84c89ac-d769-4781-b1b5-53601da3af2c.png)
Page Title
Sign in with mmem.com.auPage URL History Show full URLs
-
https://track.sl.imkatconstruction.com/lt/?p=/.eg./c7o/enb/f3y/rs/mphps//aHR0cHMlM0ElMkYlMkZldTIuY29udGFib3N0b3JhZ2...
HTTP 302
https://eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:doc/document3098.html Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://track.sl.imkatconstruction.com/lt/?p=/.eg./c7o/enb/f3y/rs/mphps//aHR0cHMlM0ElMkYlMkZldTIuY29udGFib3N0b3JhZ2UuY29tJTJGMGYwNTdiZjRkOTEzNDBkM2FlMThkNWYzMTM3MmZhN2UlM0Fkb2MlMkZkb2N1bWVudDMwOTguaHRtbCUyM2NsYXJrc29uLm1nciU0MG1tZW0uY29tLmF1/JDJ5JDEwJEkwTnVCSHlvUlcuQUIubzJ1aThCd2VsemVSWENSclN2TW5kcDN0SlVpN2dxdmhIcm9JU0Jp
HTTP 302
https://eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:doc/document3098.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://ip9uk39kv26rml8wjjruzg-on.drv.tw/jsbot.js HTTP 301
- https://ip9uk39kv26rml8wjjruzg.on.drv.tw/jsbot.js
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
document3098.html
eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:doc/ Redirect Chain
|
476 KB 326 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c2d4bde48d.js
kit.fontawesome.com/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icone-pdf-symbole-png-rouge.png
icones.pro/wp-content/uploads/2021/03/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jsbot.js
ip9uk39kv26rml8wjjruzg.on.drv.tw/ Redirect Chain
|
8 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/ |
94 KB 22 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/ |
27 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/ |
823 B 989 B |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/ |
2 KB 1 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
88 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
222 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mmem.com.au
logo.clearbit.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mmem.com.au
logo.clearbit.com/ |
4 KB 0 |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.6.0/webfonts/ |
116 KB 0 |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-fa-solid-900.ttf
ka-f.fontawesome.com/releases/v6.6.0/webfonts/ |
414 KB 169 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| FontAwesomeKitConfig function| $ function| jQuery function| myFunction string| Xeno1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
track.sl.imkatconstruction.com/ | Name: PHPSESSID Value: rbhmagv2acrl3140r8cp323ih7 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=16000000; includeSubDomains; preload; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
eu2.contabostorage.com
icones.pro
ip9uk39kv26rml8wjjruzg-on.drv.tw
ip9uk39kv26rml8wjjruzg.on.drv.tw
ka-f.fontawesome.com
kit.fontawesome.com
logo.clearbit.com
track.sl.imkatconstruction.com
www.w3schools.com
104.18.19.62
108.139.10.28
142.251.221.74
172.67.139.119
173.249.62.85
18.67.93.31
192.0.78.148
192.229.179.87
34.122.158.70
0fe073bccf9ec45538654cad51a8a1c61e7ec2c12bc959275b0756beffb859e7
1ae3c19265723696f50e3226dcd43fbc7ea617697e0d7169a8e52c854ae3826c
1fa82d030aca102b39e357291206b8b133d9f920c781c7d270d2c73f6ee7b61b
2132920b16e588a3d353ffc13dcf4a17b01adb129408aee967da06831b928a49
3274993c2ccd9b85c3597b1e5d08288dadb9611210575b093c33274c9d3bc846
4f422dc1efc7ca439c68506c34c4604a3b05c7d51f038b2d2e6d6a1fa7ae28f7
600742e96cacd86a624b9d720322338cc6797380e4c74c124b8e0e66bffec150
7f264c31cdb355f351235359240c30acae2bbe0a43c73fa6a035123e6d953a01
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
a19bc1a66fa013d0ed63913a725c69120b704df37077e50b8b8cdd4c0f4657ef
aa3b5749e0a19ad393b0d8a80a8f78edbf317bf5b067f95bad0503300fcab860
b4b91d1b8888b77fdbf5d54b3ed71f03b1473cd97bb13fadb4fe5efe0e7eaf20
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
ddfbe9ee1f7088339a85fa25a259765ade4258c082a7921b9f569ff9616f904a
f99c17690330c805c47da3d7592864d6acf0f73817d432447e1b0c66ad28f221